CVE-2026-24050: Zulip affected by Stored XSS in user profile modal
Zulip is an open-source team collaboration tool. From 5.0 to before 11.5, some administrative actions on the user profile were susceptible to stored XSS in group names or channel names. Exploiting these vulnerabilities required the user explicitly interacting with the problematic object. This vulnerability is fixed in 11.5.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-24050?
The severity of CVE-2026-24050 is classified as high due to the potential for stored XSS attacks disrupting user sessions.
How do I fix CVE-2026-24050?
To fix CVE-2026-24050, upgrade Zulip to version 11.5 or later to mitigate the stored XSS vulnerability.
What versions of Zulip are affected by CVE-2026-24050?
CVE-2026-24050 affects Zulip versions from 5.0 up to, but not including, 11.5.
What types of data can trigger CVE-2026-24050?
CVE-2026-24050 can be triggered by malicious input in group names or channel names within the user profile modal.
Who is impacted by CVE-2026-24050?
Users with administrative access to Zulip are particularly impacted by CVE-2026-24050 as they can execute actions that lead to stored XSS.