PT-2026-137102

CVE-2026-115474

Published

2026-11-04

Updated

2026-11-04

Description by

CVSS 3.1

6.5

Medium

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zulip versions 8.0 through 12.1

Description In organizations where the setting for who can view all other users restricts guests from viewing other users, saving or editing a direct message draft fails to verify if the sender has permission to access the draft recipients. This allows a guest to obtain profile information of restricted users without sending a message.

Recommendations Update to version 12.2.

Exploitability

Exploit

Fix

Impacts

Researchers

Jebeenlee

Vendors

Affected products

Weakness enumeration

CWE-862: Missing Authorization

Related identifiers