CVE-2026-105797 | Microsoft SimpleChat up to 0.261.30 MCP Plugin Authorization /api/user/plugins _reject_non_admin_mcp_stdio improper authorization

October 6, 2026 Yanac

A vulnerability was found in Microsoft SimpleChat up to 0.261.30 and classified as critical. This affects the function _reject_non_admin_mcp_stdio of the file /api/user/plugins of the component MCP Plugin Authorization. The manipulation results in improper authorization.

This vulnerability is identified as CVE-2026-105797. The attack can be executed remotely. There is not any exploit available.

It is suggested to upgrade the affected component.VulDB Recent EntriesRead More