CVE-2026-57206 Details

A vulnerability exists in SimpleChat versions prior to 0.241.206, where several plugin validation endpoints lack proper authentication and authorization checks. The affected routes, located in 'application/single_app/plugin_validation_endpoint.py', include 'POST /api/admin/plugins/test-instantiation', 'GET /api/admin/plugins/health-check/<plugin_name>', 'POST /api/admin/plugins/repair/<plugin_name>', and 'POST /api/plugins/validate'. These routes were documented to require authentication but did not enforce it at runtime, allowing unauthorized clients to access sensitive plugin management functionalities. Exploitation of these routes could lead to unauthorized access to plugin health information, configuration errors, and the ability to modify global plugin settings, particularly through the 'repair' endpoint.

Users are advised to upgrade to SimpleChat version 0.241.206 or later. For immediate needs, access to the affected admin plugin validation routes can be restricted at the server level using a reverse proxy, WAF, or similar tool. As a local source workaround, the missing authentication decorators can be manually added to the affected routes before redeploying the application.