https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 20:20:29 +0000 https://vulnerability.circl.lu/vuln/cve-2026-57205 <p><strong>Affected:</strong> microsoft simplechat</p> <p>SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.241.203, the authenticated GET /api/user/info/&lt;user_id&gt; and GET /api/user/profile-image/&lt;user_id&gt; endpoints in application/single_app/route_backend_users.py accepted a caller-supplied user_id and read the matching Cosmos DB user-settings document without object-level authorization, allowing a low-privilege authenticated user to retrieve another user&#39;s email address, display name, and profile image. This issue is fixed in version 0.241.203.</p> <p><strong>Affected:</strong> microsoft simplechat</p> <p>SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.241.203, the authenticated GET /api/user/info/&lt;user_id&gt; and GET /api/user/profile-image/&lt;user_id&gt; endpoints in application/single_app/route_backend_users.py accepted a caller-supplied user_id and read the matching Cosmos DB user-settings document without object-level authorization, allowing a low-privilege authenticated user to retrieve another user&#39;s email address, display name, and profile image. This issue is fixed in version 0.241.203.</p> https://vulnerability.circl.lu/vuln/cve-2026-57205