Access Control Vulnerability in Zulip Team Collaboration Tool

CVE-2026-115574

What is CVE-2026-115574?

Zulip, an open-source team collaboration platform, is affected by an access control vulnerability that allows unauthorized users to access sensitive information. Specifically, from version 11.0 up to 12.2, organizations with publicly accessible channels inadvertently exposed the GET /json/users endpoint to users who were not logged in. A flaw in access control checks permitted the inclusion of custom profile fields, leading to the exposure of sensitive user data to unauthenticated visitors. This vulnerability has been resolved in version 12.2, emphasizing the importance of keeping software updated to mitigate potential risks.

References