This site currently shows sample data for demonstration.
BDVDB
বাংলা

Vulnerabilities

CVE-2026-57205 | BDVDB-2026-349002 Detail

Microsoftsimplechat

Description#

SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.241.203, the authenticated GET /api/user/info/<user_id> and GET /api/user/profile-image/<user_id> endpoints in application/single_app/route_backend_users.py accepted a caller-supplied user_id and read the matching Cosmos DB user-settings document without object-level authorization, allowing a low-privilege authenticated user to retrieve another user's email address, display name, and profile image. This issue is fixed in version 0.241.203.

Impact#

Per CVSS v3.1: confidentiality impact low, integrity impact none, availability impact none. Attack vector: network.

Weaknesses#

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
  • CWE-639 Authorization Bypass Through User-Controlled Key
  • CWE-862 Missing Authorization

References#

Exploit#

No public exploit known

History#

  1. Version 1Record published in the CVE List.