The vulnerability enables an authenticated low‑privileged user to manipulate the authorization ordering in the POST /api/user/plugins endpoint, which bypasses a rejection check and eventually triggers an attacker‑selected operating‑system process to run under the application service identity. This command injection allows the attacker to expose or modify secrets and data available to the service, or disrupt the service. The weakness involves improper ordering of authorization checks and command injection (CWE‑78, CWE‑863).

Microsoft SimpleChat is affected, specifically versions 0.261.003 and 0.261.027. The flaw is resolved in version 0.261.031. Exploitation requires personal plugins to be enabled and governance configured to permit MCP actions, and it is only available to authenticated low‑privileged users.

The CVSS score of 8.8 indicates high severity. EPSS information is not available, and the vulnerability is not listed in CISA KEV, so no known active exploits are reported. The likely attack vector is through authenticated requests to the API by a low‑privileged user within the same internal network. Because the application service identity runs with elevated rights, successful exploitation could lead to data leakage, modification of secrets, or complete service disruption. The high severity and potential impact warrant urgent attention.