CVE-2026-115574 Scanner

Zulip Server is widely used by organizations to facilitate internal team communication via streams and topics. Organizations of different scales and sizes implement Zulip Server to foster collaborative discussions and enhance real-time communication among team members in various departments. The platform is designed to integrate with other workplace tools, enhancing its functionality for project management and operational workflows. Custom profile fields in Zulip Server allow users to share essential personal information relevant to collaborative efforts within the team environment. This information becomes part of user profiles and can be leveraged to improve internal communication processes within organizations. Zulip's flexibility and user-centric design make it popular among open-source projects and organizations seeking an adaptable communication tool.

The vulnerability pertains to an information disclosure flaw, identified in versions 11.0 to 12.1 of Zulip Server, due to a missing access-control check in the GET /json/users endpoint. This specific flaw allows unauthenticated users to access all users' custom profile fields. As such, it exposes sensitive user information, including personally identifiable information, which may be susceptible to misuse by unauthorized parties. The vulnerability poses a significant privacy concern, especially in environments where web-public channels are enabled. Attackers exploiting this flaw without necessitating authentication or special access privileges can easily compromise user data.

Technically, the vulnerability stems from inadequate access control within the endpoint responsible for handling user data requests. Specifically, the GET /json/users endpoint lacks sufficient verification to ensure only authenticated requests access certain profile data. This vulnerability becomes exploitable primarily when Zulip's web-public channels, which allow public posting without authentication, are enabled. An attacker can specifically craft requests to extract sensitive user profile details, exploiting the server's inadequate checks. During exploitation, unauthorized users may retrieve JSON responses containing sensitive data fields like \"profile_data,\" \"members,\" and others related to user identities.

If exploited, this vulnerability could lead to unauthorized access to sensitive personal information stored within custom profile fields of the affected Zulip server instances. Malicious actors could manipulate or misappropriate the disclosed information for phishing, identity theft, or other nefarious activities. Such unauthorized data exposure could harm organizational operations, leading to diminished trust and potential loss of stakeholder confidence. Organizations could face compliance violations, especially if protected by specific data privacy regulations such as GDPR or HIPAA.

REFERENCES

• https://github.com/zulip/zulip/security/advisories/GHSA-3m37-hwq6-jrj8
• https://github.com/zulip/zulip/commit/6f33a8fa345ba776039a3f46131c253599a3ba15
• https://github.com/zulip/zulip/commit/774d4c7b12755178fa406f0c0f3b2cafdbbec32c
• https://github.com/zulip/zulip/pull/39913
• https://nvd.nist.gov/vuln/detail/CVE-2026-115574