Vulnerability · Published Jul 16, 2026 · Assigned by GitHub_M

CVE-2026-57205SimpleChat: Authenticated users can access other users' profile metadata through user IDOR endpoints

Medium 4.3

In plain English

A medium-severity information exposure in simplechat from microsoft. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.9%top 39.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.241.203, the authenticated GET /api/user/info/<user_id> and GET /api/user/profile-image/<user_id> endpoints in application/single_app/route_backend_users.py accepted a caller-supplied user_id and read the matching Cosmos DB user-settings document without object-level authorization, allowing a low-privilege authenticated user to retrieve another user's email address, display name, and profile image. This issue is fixed in version 0.241.203.

Affected products (as reported)

Vendor	Product	Versions
microsoft	simplechat	< 0.241.203

Weakness: CWE-200, CWE-639, CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/microsoft/simplechat/security/advisories/GHSA-x2jq-2m5m-65m4 x_refsource_CONFIRM
https://github.com/microsoft/simplechat/blob/main/docs/explanation/fixes/USER_PROFILE_IDOR_AUTHORIZATION_FIX.md x_refsource_MISC
https://github.com/microsoft/simplechat/releases/tag/v0.250.001 x_refsource_MISC