CVE-2026-57205: SimpleChat: Authenticated users can access other users' profile metadata through user IDOR endpoints
SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.241.203, the authenticated GET /api/user/info/<userid> and GET /api/user/profile-image/<userid> endpoints in application/singleapp/routebackendusers.py accepted a caller-supplied userid and read the matching Cosmos DB user-settings document without object-level authorization, allowing a low-privilege authenticated user to retrieve another user's email address, display name, and profile image. This issue is fixed in version 0.241.203.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SimpleChat (application/single_app/route_backend_users.py IDOR fix)to a version that resolves this vulnerability.Fixed in 0.241.203
Event History
Frequently Asked Questions
What is the severity of CVE-2026-57205?
The severity of CVE-2026-57205 is medium with a score of 4.3.
How do I fix CVE-2026-57205?
To fix CVE-2026-57205, upgrade SimpleChat to version 0.250.001 or later.
What types of data are exposed in CVE-2026-57205?
CVE-2026-57205 allows unauthorized access to other users' profile metadata through improper authorization.
Which endpoints are affected by CVE-2026-57205?
The affected endpoints in CVE-2026-57205 are GET /api/user/info/<user_id> and GET /api/user/profile-image/<user_id>.
What is the impact of CVE-2026-57205?
The impact of CVE-2026-57205 is an information leak that can lead to unauthorized access to personal user data.