Executive Summary

This vulnerability affects Zulip, an open-source team collaboration tool, in versions from 1.4.0 up to but not including 11.6. Even when spectator access is disabled, attachments from web-public streams can still be accessed anonymously. Additionally, the endpoint that provides topic history for web-public streams remains accessible without authentication. This means that files and topic histories intended to be private after disabling public access remain exposed.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows unauthorized users to access attachments and topic histories from web-public streams even after public access has been disabled. This can lead to unintended information disclosure, where sensitive or confidential files and discussions may be viewed by anonymous users without permission.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade Zulip to version 11.6 or later, where the issue has been patched.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows anonymous retrieval of attachments and topic history from web-public streams even after spectator access is disabled. This could lead to unauthorized access to potentially sensitive information.

Such unauthorized access to data may impact compliance with data protection regulations like GDPR and HIPAA, which require controlling access to personal and sensitive information.

However, the provided information does not explicitly state the direct impact on compliance with these standards.

Useful 0 Not Useful 0