CVE-2026-57206

Name of the Vulnerable Software and Affected Versions SimpleChat versions prior to 0.241.206

Description Several plugin validation routes in application/single app/plugin validation endpoint.py failed to enforce runtime authentication and authorization checks. While the documentation indicated security requirements, the application did not implement @login required, @user required, or @admin required, allowing unauthenticated or unauthorized clients to trigger plugin validation, health, and repair actions. The affected endpoints are POST /api/admin/plugins/test-instantiation, GET /api/admin/plugins/health-check/<plugin name>, POST /api/admin/plugins/repair/<plugin name>, and POST /api/plugins/validate.

Recommendations Update to version 0.241.206.