CVE-2026-25742
Unauthorized Access in Zulip Allows Anonymous Attachment and Topic Retrieval
Publication date: 2026-04-03
Last updated on: 2026-04-13
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| zulip | zulip | From 1.4.0 (inc) to 11.6 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects Zulip, an open-source team collaboration tool, in versions from 1.4.0 up to but not including 11.6. Even when spectator access is disabled, attachments from web-public streams can still be accessed anonymously. Additionally, the endpoint that provides topic history for web-public streams remains accessible without authentication. This means that files and topic histories intended to be private after disabling public access remain exposed.
How can this vulnerability impact me? :
The vulnerability allows unauthorized users to access attachments and topic histories from web-public streams even after public access has been disabled. This can lead to unintended information disclosure, where sensitive or confidential files and discussions may be viewed by anonymous users without permission.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade Zulip to version 11.6 or later, where the issue has been patched.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows anonymous retrieval of attachments and topic history from web-public streams even after spectator access is disabled. This could lead to unauthorized access to potentially sensitive information.
Such unauthorized access to data may impact compliance with data protection regulations like GDPR and HIPAA, which require controlling access to personal and sensitive information.
However, the provided information does not explicitly state the direct impact on compliance with these standards.