CVE-2026-105797 in SimpleChat
Summary
by MITRE • 10/06/2026
SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. In versions 0.261.003 and 0.261.027, an authorization ordering flaw in POST /api/user/plugins allows an authenticated low-privileged user to omit the top-level MCP type so that _reject_non_admin_mcp_stdio skips inspection before the type is restored from metadata. The stored personal action can then reach McpPluginFactory.create_connector, and MCPStdioPlugin.connect starts the attacker-selected operating-system process under the application service identity when the action tool is invoked. Exploitation requires personal plugins to be enabled and governance to permit MCP actions, and it can expose or modify secrets and data available to the service or disrupt the service. This issue is fixed in version 0.261.031.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/06/2026
The vulnerability identified in SimpleChat versions 0.261.003 through 0.261.027 represents a critical authorization ordering flaw within the application's plugin management subsystem, specifically affecting the POST /api/user/plugins endpoint. This issue stems from an improper sequence of security checks during the processing of user-submitted configurations for Model Context Protocol (MCP) plugins. The core technical failure lies in how the system handles metadata restoration versus access control validation. When a low-privileged authenticated user submits a plugin configuration, the application initially invokes the _reject_non_admin_mcp_stdio function to inspect and restrict certain types of MCP connections based on administrative privileges. However, due to an ordering error, this security check executes before the top-level MCP type is restored from stored metadata. Consequently, if the attacker omits or manipulates the explicit type field in the initial request payload, the validation logic fails to identify the configuration as a restricted stdio-based plugin because it lacks the necessary context at that specific moment of execution.
Once this inspection bypass occurs, the maliciously crafted personal action is permitted to proceed through the application's initialization pipeline and reaches the McpPluginFactory.create_connector method. This factory method subsequently instantiates an MCPStdioPlugin object by calling its connect function. The critical operational impact arises here: the connection process initiates a new operating-system process using arguments selected entirely by the attacker, running under the identity of the SimpleChat application service account rather than the user's own privileges. Because this execution occurs within the context of the backend service, it grants the low-privileged user effective command-line access to the server environment where the application is hosted. This represents a severe escalation from simple web-based interaction to remote code execution capabilities relative to the service identity.
The exploitation of this vulnerability requires specific environmental conditions: personal plugins must be enabled within the SimpleChat configuration, and governance policies must permit MCP actions for non-administrative users. Despite these prerequisites being common in many deployments, their presence allows an attacker to leverage this flaw to expose sensitive data or modify critical system resources available to the service account. The consequences are significant, ranging from unauthorized access to secrets such as API keys and database credentials stored on the server, to potential modification of application state or disruption of services through resource exhaustion or malicious process execution. This aligns with CWE-269 (Improper Privilege Management) regarding authorization bypass due to incorrect ordering, and maps closely to MITRE ATT&CK technique T1059 (Command and Scripting Interpreter), as the attacker effectively executes arbitrary system commands via the application's backend processes.
To mitigate this vulnerability, organizations must immediately upgrade SimpleChat to version 0.261.031 or later, where the authorization logic has been corrected to ensure that type restoration occurs prior to privilege checks. In environments where upgrading is not immediately feasible, administrators should disable personal plugins entirely if they are not strictly required for business operations. Additionally, restricting governance policies to prohibit MCP actions for non-administrative users can prevent exploitation of this specific vector. Continuous monitoring of application logs for unusual process creation events originating from the SimpleChat service account is also recommended to detect any potential active exploitation attempts in legacy deployments.