CVE-2026-57205

Name of the Vulnerable Software and Affected Versions SimpleChat versions prior to 0.241.203

Description An issue exists in the authenticated endpoints '/api/user/info/' and '/api/user/profile-image/' within the application/single app/route backend users.py file. These endpoints accept a caller-supplied user id and access the corresponding Cosmos DB user-settings document without performing object-level authorization. This allows a low-privilege authenticated user to retrieve the email address, display name, and profile image of other users.

Recommendations Update to version 0.241.203. Restrict access to the user id parameter in the '/api/user/info/' and '/api/user/profile-image/' endpoints to prevent unauthorized data retrieval.