Microsoft SimpleChat versions before 0.241.206 contain a missing authentication vulnerability (CWE-306) in multiple plugin validation routes within application/single_app/plugin_validation_endpoint.py. Although these routes were documented with security requirements via @swagger_route, they lacked runtime enforcement of authentication decorators such as @login_required, @user_required, or @admin_required. This allowed unauthenticated or unauthorized clients to access sensitive plugin validation, health check, and repair functionalities. The vulnerability is addressed by adding proper authentication enforcement in version 0.241.206.

An attacker can invoke critical plugin validation, health check, and repair endpoints without authentication or authorization. This could lead to unauthorized modification or disruption of plugin functionality, potentially impacting integrity and availability of the application. Confidentiality impact is limited to the plugin validation context. The CVSS 3.1 base score is 8.6 (high), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on integrity with low impact on confidentiality and availability.

Upgrade Microsoft SimpleChat to version 0.241.206 or later, where the missing authentication enforcement is fixed. No other mitigations are indicated. Patch status is not explicitly stated as 'official-fix' or 'patchAvailable' but the description confirms the issue is fixed in 0.241.206.