PT-2026-137103
CVE-2026-115574
·
Published
2026-11-04
·
Updated
2026-11-05
Description by
CVSS 3.1
5.3
MediumMetricsAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Name of the Vulnerable Software and Affected Versions
Zulip versions 11.0 through 12.1
Description
Organizations with web-public channels enabled expose the 'GET /json/users' endpoint to unauthenticated spectators. A missing access-control check allows the
include custom profile fields variable, when set to true, to return custom profile field values for every user instead of the standard limited directory data.Recommendations
Update to version 12.2.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾