TI-2026-68450 Aliases CVE-2026-105797

Authorization ordering flaw in SimpleChat allows OS command injection

HIGH 73CWE-78Published 2026-10-06 · Updated 2026-10-06

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Code execution, Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-78 and CWE-863.

Summary

SimpleChat versions 0.261.003 and 0.261.027 contain an authorization ordering flaw in POST /api/user/plugins, where a type check is skipped before a stored plugin is restored, which leads to OS command injection (CWE-78). An authenticated low-privileged user can store a personal action that starts an attacker-selected operating-system process under the application service identity when the action's tool is invoked. Exploitation requires personal plugins to be enabled and governance to permit MCP actions. The attacker can expose or modify secrets and data available to the service or disrupt the service.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. In versions 0.261.003 and 0.261.027, an authorization ordering flaw in POST /api/user/plugins allows an authenticated low-privileged user to omit the top-level MCP type so that _reject_non_admin_mcp_stdio skips inspection before the type is restored from metadata. The stored personal action can then reach McpPluginFactory.create_connector, and MCPStdioPlugin.connect starts the attacker-selected operating-system process under the application service identity when the action tool is invoked. Exploitation requires personal plugins to be enabled and governance to permit MCP actions, and it can expose or modify secrets and data available to the service or disrupt the service. This issue is fixed in version 0.261.031.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00564 47th percentileScored 2026-11-07

Fix Fixed simplechat (microsoft): 0.261.031

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Microsoft	simplechat	before 0.261.031	0.261.031	Patch available	CNA

simplechat VendorMicrosoft Affected before 0.261.031 Fixed in 0.261.031 Patch available CNA

Remediation

Upgrade SimpleChat to version 0.261.031, which fixes the issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Fix · CNA simplechat (microsoft) Fixed in 0.261.031

Timeline

2026-10-06 Threatist record created from CVE-2026-105797
2026-10-06 CISA SSVC decision points changed
2026-10-06 Priority changed: MEDIUM → HIGH

References

Other 2

TI-2026-42212 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2026-37256 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2026-26194 Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2026-16982 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2025-36863 Windows Server Update Service (WSUS) Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2025-33671 Microsoft SharePoint Server Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8

See all 18045 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences