CVE-2026-115574

Zulip is an open-source team collaboration tool. From 11.0 until 12.2, organizations with web-public channels enabled exposed the GET /json/users endpoint to logged-out spectators, and a missing access-control check allowed includecustomprofilefields=true to return every user's custom profile fie...

CVE-2026-115574 Zulip: Custom profile fields can be read by logged-out visitors in organization with web-public channels

Zulip is an open-source team collaboration tool. From 11.0 until 12.2, organizations with web-public channels enabled exposed the GET /json/users endpoint to logged-out spectators, and a missing access-control check allowed includecustomprofilefields=true to return every user's custom profile fie...

CVE-2026-115574

The team collaboration tool Zulip versions 11.0 through 12.2 is vulnerable to an information disclosure flaw. When web-public channels are enabled, the GET /json/users endpoint is exposed to logged-out spectators. Due to a missing access-control check, unauthenticated visitors can use the include...

PT-2026-137103

Name of the Vulnerable Software and Affected Versions Zulip versions 11.0 through 12.1 Description Organizations with web-public channels enabled expose the 'GET /json/users' endpoint to unauthenticated spectators. A missing access-control check allows the include custom profile fields variable,...

PT-2026-51435

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, IdentityResourceV1.queryCollection passes the queryId parameter from /json/realm/users to CrestQuery with escapeQueryId disabled, bypassing protection added for CVE-2021-29156. The unescaped value reaches...