CVE-2026-115574
Received Received - Intake

Zulip Custom Profile Field Exposure via Missing Access Control

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: GitHub, Inc.

Description
Zulip is an open-source team collaboration tool. From 11.0 until 12.2, organizations with web-public channels enabled exposed the GET /json/users endpoint to logged-out spectators, and a missing access-control check allowed include_custom_profile_fields=true to return every user's custom profile field values in addition to the documented limited directory data. This exposed those custom profile field values to unauthenticated visitors. This issue is fixed in version 12.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-04
AI Q&A
2026-11-04
EPSS Evaluated
N/A
NVD
CVE-2026-115574
EUVD
EUVD-2026-117033

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
zulip zulip >= 11.0, < 12.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Zulip (versions 11.0 to 12.2) allows unauthenticated users to access custom profile field values of all users via the GET /json/users endpoint when web-public channels are enabled. The issue occurs because the include_custom_profile_fields=true parameter incorrectly returns sensitive data like phone numbers, birthdays, and pronouns, despite only limited directory data being intended for public view.

Detection Guidance

To detect exposure of custom profile fields via CVE-2026-115574, check if your Zulip instance allows unauthenticated access to /json/users with include_custom_profile_fields=true. Use curl to test: curl -s 'https://your-zulip-server/json/users?include_custom_profile_fields=true' and verify if sensitive data like phone numbers or birthdays is returned. If web-public channels are enabled, this indicates the vulnerability exists.

Impact Analysis

If you are a Zulip user in an organization with web-public channels enabled, your custom profile fields (e.g., phone numbers, birthdays, pronouns) may have been exposed to unauthorized visitors. Attackers could exploit this to gather personal information without authentication, potentially leading to privacy breaches or targeted phishing attempts.

Compliance Impact

This vulnerability likely violates data protection regulations like GDPR and HIPAA by exposing personal user data without consent. GDPR requires strict handling of personal data, and HIPAA mandates safeguards for protected health information. Organizations using affected Zulip versions may face compliance violations and legal consequences.

Mitigation Strategies

Upgrade to Zulip server version 12.2 or later to patch the issue. If upgrading is not immediately possible, disable web-public channels by unsetting the web-public setting on all channels or disabling the option to create web-public channels entirely. This prevents unauthenticated access to the vulnerable endpoint.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-115574. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...