Microsoft SimpleChat: Command execution via authorization-gate ordering flaw in MCP plugins
Summary
SimpleChat, an AI conversation application with personal and group workspaces, contains an authorization ordering flaw in the endpoint for saving user plugins. An authenticated low-privileged user can register a personal MCP action with the stdio transport by omitting the top-level type field, which bypasses the check that restricts stdio to administrator-managed global actions. When an agent invokes a tool of this action, the application starts an attacker-chosen operating system process under the application's service identity. Exploitation requires personal plugins to be enabled and governance to permit MCP actions. An attacker could access secrets and data available to the service or disrupt the service.
Affected
- SimpleChat versions 0.261.003 and 0.261.027 (named in the CVE record)
- All versions below 0.261.031 (CNA range; vendor confirmation of intermediate and older versions pending)
Fixed in
- Fixed in version 0.261.031
Workaround
- No vendor-documented workaround known.
- Interim measure (not from the vendor): disable personal plugins or MCP actions in the admin settings until the update is installed.
Exploitation
- CISA SSVC: exploitation status 'poc', automatable 'no', technical impact 'total'.
- Not listed in CISA KEV.
- No reports of in-the-wild exploitation found.
- Public exploit availability not confirmed.
Our recommendation
- Update SimpleChat to version 0.261.031 or later.
- Until patched, disable personal plugins or MCP actions in the admin settings.
- Review existing personal actions for stdio-type MCP entries created by non-admin users and remove them.
- Check which secrets and managed identities the application can access and rotate them if misuse is suspected.
- Monitor the application host for unexpected child processes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record details (NVD) vulners.com
- GitHub Security Advisory GHSA-h4mw-qw8m-5x4j github.com
- Fix commit 73ff7d6 github.com
- OSV entry CVE-2026-105797 osv.dev
- OpenCVE CVE-2026-105797 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 22:16.
Original description (NVD)
SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. In versions 0.261.003 and 0.261.027, an authorization ordering flaw in POST /api/user/plugins allows an authenticated low-privileged user to omit the top-level MCP type so that _reject_non_admin_mcp_stdio skips inspection before the type is restored from metadata. The stored personal action can then reach McpPluginFactory.create_connector, and MCPStdioPlugin.connect starts the attacker-selected operating-system process under the application service identity when the action tool is invoked. Exploitation requires personal plugins to be enabled and governance to permit MCP actions, and it can expose or modify secrets and data available to the service or disrupt the service. This issue is fixed in version 0.261.031.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.