CVE-2026-105797
Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-06

Assigner: GitHub, Inc.

Description
SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. In versions 0.261.003 and 0.261.027, an authorization ordering flaw in POST /api/user/plugins allows an authenticated low-privileged user to omit the top-level MCP type so that _reject_non_admin_mcp_stdio skips inspection before the type is restored from metadata. The stored personal action can then reach McpPluginFactory.create_connector, and MCPStdioPlugin.connect starts the attacker-selected operating-system process under the application service identity when the action tool is invoked. Exploitation requires personal plugins to be enabled and governance to permit MCP actions, and it can expose or modify secrets and data available to the service or disrupt the service. This issue is fixed in version 0.261.031.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-06
Last Modified
2026-10-06
Generated
2026-10-19
AI Q&A
2026-10-06
EPSS Evaluated
2026-10-18
NVD
CVE-2026-105797
EUVD
EUVD-2026-93426

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
microsoft simplechat < 0.261.031

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SimpleChat versions 0.261.003 and 0.261.027 have an authorization flaw in the POST /api/user/plugins endpoint. An authenticated low-privileged user can bypass admin checks by omitting the top-level MCP type, allowing malicious actions to execute under the application service identity. This can lead to unauthorized access, data exposure, or service disruption if personal plugins and MCP actions are enabled.

Detection Guidance

Detection requires checking SimpleChat versions for 0.261.003 or 0.261.027 and verifying if personal plugins are enabled. Review logs for unauthorized MCP actions or unexpected process execution under the service identity.

Impact Analysis

If you use SimpleChat with personal plugins enabled and MCP actions permitted, an attacker could exploit this to run unauthorized operating-system processes. This may expose or modify sensitive data accessible to the service, or disrupt service operations. The impact depends on the service's permissions and data access.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information. Compliance risks include data breaches, lack of audit trails, and failure to maintain adequate security controls.

Mitigation Strategies

Update SimpleChat to version 0.261.031 or later to fix the authorization flaw. Disable personal plugins if not required and review governance policies to restrict MCP actions until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-105797. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart