SimpleChat’s plugin validation endpoints were missing runtime authentication and authorization checks, allowing callers to submit requests for testing, health checking, repairing, or validating plugins without proving identity or privileges. This flaw can permit malicious actors to invoke administrative functionality, potentially causing unintended plugin state changes or denial of service. The vulnerability matches CWE-306 (Missing Authentication) and CWE-862 (Missing Authorization), indicating that both authentication and permission enforcement were inadequately applied.

The issue applies to Microsoft SimpleChat versions earlier than 0.241.206. Versions 0.241.206 and later contain a fix that enforces proper login or administrative checks on the affected routes.

The CVSS score of 8.6 classifies the flaw as high severity. EPSS score of < 1% indicates a very low, but non-zero, exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. A likely attack vector is the exposed HTTP API endpoints; based on the description, it is inferred that an unauthenticated network user could send a POST or GET request to the specified URLs to perform administrative actions. To exploit the flaw, no special privileges or additional permissions are required, making it broadly actionable for attackers who can reach the API.