Guest Access Flaw in Zulip Team Collaboration Tool

CVE-2026-115474

What is CVE-2026-115474?

Zulip, an open-source team collaboration tool, contains a vulnerability affecting versions from 8.0 to 12.1. In organizations with restricted guest access settings, the application does not adequately verify if a guest user can access draft messages meant for restricted users. This oversight enables unauthorized access to profile information of users that guests shouldn’t normally see, posing a significant privacy risk. Users with unrestricted guest access are not impacted. This issue has been addressed in version 12.2, ensuring that proper access controls are enforced.

References