Missing authorization in Zulip exposes custom profile fields to visitors
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.
Summary
Zulip from 11.0 before 12.2 exposes custom profile field values to logged-out visitors in organizations with web-public channels enabled. A missing authorization check lets the GET /json/users endpoint return every user's custom profile field values when include_custom_profile_fields=true is set, beyond the documented limited directory data (CWE-862). An unauthenticated remote attacker can read these values without logging in.
Written with Claude Haiku 5.5 from the sources below · 2026-11-04
Description from the CNA
Zulip is an open-source team collaboration tool. From 11.0 until 12.2, organizations with web-public channels enabled exposed the GET /json/users endpoint to logged-out spectators, and a missing access-control check allowed include_custom_profile_fields=true to return every user's custom profile field values in addition to the documented limited directory data. This exposed those custom profile field values to unauthenticated visitors. This issue is fixed in version 12.2.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
Upgrade Zulip to version 12.2, which fixes the issue.
Written with Claude Haiku 5.5 from the sources below · 2026-11-04
- Fix · CNA zulip (zulip) Fixed in 12.2
Timeline
- 2026-11-04 Threatist record created from CVE-2026-115574
- 2026-11-05 CISA SSVC decision points changed
- 2026-11-06 EPSS moved to the 50th–90th percentile
References
Other 6
- https://github.com/zulip/zulip/security/advisories/GHSA-3m37-hwq6-jrj8
- https://github.com/zulip/zulip/pull/39913
- https://github.com/zulip/zulip/commit/6f33a8fa345ba776039a3f46131c253599a3ba15
- https://github.com/zulip/zulip/commit/774d4c7b12755178fa406f0c0f3b2cafdbbec32c
- https://github.com/zulip/zulip/releases/tag/12.2
- https://zulip.readthedocs.io/en/latest/overview/changelog.html#zulip-server-12-2
More zulip vulnerabilities
- TI-2024-37129 /api/v1/jwt/fetch_api_key endpoint can leak if an email address has an account in Zulip server CVSS 4.0MEDIUM 6.9
- TI-2026-20810 Zulip: Anonymous File Access After Disabling Spectator Access CVSS 3.1MEDIUM 5.3
- TI-2026-21062 Zulip: Path Traversal in Import CVSS 3.1MEDIUM 6.1
- TI-2021-19605 RabbitMQ exposes ports with weak default secrets in Zulip Server CVSS 3.1CRITICAL 9.8
- TI-2022-06082 Multi-use invitations can grant access to other organizations in Zulip CVSS 3.1CRITICAL 9.8
- TI-2023-15953 Users who can send invitations can erroneously add users to streams during invitation in Zulip CVSS 3.1LOW 3.1
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences