CVE-2026-115574: Zulip: Custom profile fields can be read by logged-out visitors in organization with web-public channels
Zulip is an open-source team collaboration tool. From 11.0 until 12.2, organizations with web-public channels enabled exposed the GET /json/users endpoint to logged-out spectators, and a missing access-control check allowed includecustomprofilefields=true to return every user's custom profile field values in addition to the documented limited directory data. This exposed those custom profile field values to unauthenticated visitors. This issue is fixed in version 12.2.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Zulipto a version that resolves this vulnerability.Fixed in 12.2
Event History
Frequently Asked Questions
Which deployments are exposed to unauthenticated access?
Organizations that have web-public channels enabled are affected if they run a vulnerable release from 11.0 through before 12.2. Logged-out spectators can access the affected endpoint in those deployments.
What can an unauthenticated attacker retrieve?
An attacker can request GET /json/users with include_custom_profile_fields=true and obtain every user's custom profile field values. The endpoint otherwise exposes only limited directory data.
Is authentication or user interaction required to exploit this issue?
No. The issue can be exploited by a logged-out visitor, with no credentials or user interaction required.
What is the available remediation?
Upgrade to Zulip 12.2, which fixes the missing access-control check. The provided information does not specify an interim mitigation if upgrading is not immediately possible.