EUVD-2026-44941Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-accessible REST API requires only a valid user session (PR:L); no complexity or interaction needed; impact is read-only exposure of profile metadata, no integrity or availability effect.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.241.203, the authenticated GET /api/user/info/<user_id> and GET /api/user/profile-image/<user_id> endpoints in application/single_app/route_backend_users.py accepted a caller-supplied user_id and read the matching Cosmos DB user-settings document without object-level authorization, allowing a low-privilege authenticated user to retrieve another user's email address, display name, and profile image. This issue is fixed in version 0.241.203.
AnalysisAI
Insecure Direct Object Reference (IDOR) in Microsoft SimpleChat exposes any authenticated user's profile data to other authenticated users without authorization checks. The GET /api/user/info/<user_id> and GET /api/user/profile-image/<user_id> endpoints in route_backend_users.py accept a caller-supplied user_id and query the Cosmos DB user-settings document directly, bypassing object-level authorization - enabling enumeration of email addresses, display names, and profile images across the entire user base. No public exploit code has been identified at time of analysis, and the issue is not listed in the CISA KEV catalog; the vendor-released fix is version 0.241.203.
Technical ContextAI
SimpleChat is a Microsoft open-source AI conversation platform that uses Azure Cosmos DB as its user-settings store, with a Python backend exposing REST API routes via route_backend_users.py. The vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and specifically instantiates the IDOR pattern (a subclass of CWE-639): the application authenticates the caller but does not verify that the caller's identity matches or has permission to access the requested user_id resource. Because Cosmos DB document retrieval is keyed directly on the caller-supplied user_id path parameter, any valid session token can be used to query any user record. The affected CPE is cpe:2.3:a:microsoft:simplechat:*:*:*:*:*:*:*:* covering all versions prior to 0.241.203.
RemediationAI
Upgrade to Microsoft SimpleChat version 0.241.203 or later, which introduces object-level authorization checks on the affected user info and profile-image endpoints. The vendor fix is documented at https://github.com/microsoft/simplechat/blob/main/docs/explanation/fixes/USER_PROFILE_IDOR_AUTHORIZATION_FIX.md and the security advisory is available at https://github.com/microsoft/simplechat/security/advisories/GHSA-x2jq-2m5m-65m4. If immediate upgrade is not possible, a compensating control is to restrict network access to the /api/user/info/ and /api/user/profile-image/ endpoint paths at the API gateway or reverse proxy layer, allowing only requests where the authenticated caller's user ID matches the requested user_id parameter - this requires custom middleware and carries a risk of breaking legitimate profile-viewing features. Alternatively, deploying the application in a network segment accessible only to fully trusted internal users reduces, but does not eliminate, exposure from malicious insiders.
More in Simplechat
View allSame weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today