CVE-2026-115574

    Dashboard / Vulnerabilities / CVE-2026-115574

    CVE-2026-115574

    Published: 4 Nov 2026Last Modified: 8 Nov 2026

    Summary: Zulip: Custom profile fields can be read by logged-out visitors in organization with web-public channels

    Details: Zulip is an open-source team collaboration tool. From 11.0 until 12.2, organizations with web-public channels enabled exposed the GET /json/users endpoint to logged-out spectators, and a missing access-control check allowed include_custom_profile_fields=true to return every user's custom profile field values in addition to the documented limited directory data. This exposed those custom profile field values to unauthenticated visitors. This issue is fixed in version 12.2.

    References: https://github.com/zulip/zulip/releases/tag/12.2, https://zulip.readthedocs.io/en/latest/overview/changelog.html#zulip-server-12-2, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/115xxx/CVE-2026-115574.json, https://github.com/zulip/zulip/security/advisories/GHSA-3m37-hwq6-jrj8, https://nvd.nist.gov/vuln/detail/CVE-2026-115574, https://github.com/zulip/zulip/commit/6f33a8fa345ba776039a3f46131c253599a3ba15, https://github.com/zulip/zulip/commit/774d4c7b12755178fa406f0c0f3b2cafdbbec32c, https://github.com/zulip/zulip/pull/39913

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- d072421f07be8db4e641c612997c3051002e017d
    Fixed -1e73e1d754761b73c18135a3f25d0673f31cd8b3

    Affected versions

    12.1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-115574 | CVE-DB