CVE-2026-115574

Zulip is an open-source team collaboration tool. From 11.0 until 12.2, organizations with web-public channels enabled exposed the GET /json/users endpoint to logged-out spectators, and a missing access-control check allowed includecustomprofilefields=true to return every user's custom profile fie...

CVE-2026-115474

Zulip is an open-source team collaboration tool. From 8.0 until 12.2, in organizations where the Who can view all other users in the organization setting restricted guests from viewing other users, saving or editing a direct message draft did not verify that the sender could access the draft...

CVE-2026-97701

Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, the authenticated POST /messages/render endpoint renders the content parameter without enforcing the normal message length limit used by message send and edit operations. An authenticated user can submit...

CVE-2026-115474

The open-source team collaboration tool Zulip versions 8.0 through 12.2 are vulnerable to a permission bypass (CWE-862). In organizations where guests are restricted from viewing other users, the system fails to verify if a sender has permission to access draft recipients when saving or editing a...

CVE-2026-115474 Zulip: Saving a draft DM to a user bypasses can_access_all_users_group permission

Zulip is an open-source team collaboration tool. From 8.0 until 12.2, in organizations where the Who can view all other users in the organization setting restricted guests from viewing other users, saving or editing a direct message draft did not verify that the sender could access the draft...

CVE-2026-115474 Zulip: Saving a draft DM to a user bypasses can_access_all_users_group permission

Zulip is an open-source team collaboration tool. From 8.0 until 12.2, in organizations where the Who can view all other users in the organization setting restricted guests from viewing other users, saving or editing a direct message draft did not verify that the sender could access the draft...

CVE-2026-115574 Zulip: Custom profile fields can be read by logged-out visitors in organization with web-public channels

Zulip is an open-source team collaboration tool. From 11.0 until 12.2, organizations with web-public channels enabled exposed the GET /json/users endpoint to logged-out spectators, and a missing access-control check allowed includecustomprofilefields=true to return every user's custom profile fie...

CVE-2026-115574

The team collaboration tool Zulip versions 11.0 through 12.2 is vulnerable to an information disclosure flaw. When web-public channels are enabled, the GET /json/users endpoint is exposed to logged-out spectators. Due to a missing access-control check, unauthenticated visitors can use the include...

CVE-2026-115574 Zulip: Custom profile fields can be read by logged-out visitors in organization with web-public channels

Zulip is an open-source team collaboration tool. From 11.0 until 12.2, organizations with web-public channels enabled exposed the GET /json/users endpoint to logged-out spectators, and a missing access-control check allowed includecustomprofilefields=true to return every user's custom profile fie...

CVE-2026-97701 Zulip: Missing content-length limit on POST /messages/render allows denial-of-service via oversized requests

Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, the authenticated POST /messages/render endpoint renders the content parameter without enforcing the normal message length limit used by message send and edit operations. An authenticated user can submit...

CVE-2026-97701

Zulip Server versions through 12.1 are vulnerable to a resource exhaustion issue in the POST /messages/render endpoint. The vulnerability occurs because the content parameter is rendered without enforcing the standard message length limits applied to message send and edit operations. An authentic...

EUVD-2026-117032

Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, the authenticated POST /messages/render endpoint renders the content parameter without enforcing the normal message length limit used by message send and edit operations. An authenticated user can submit...

CVE-2026-97701 Zulip: Missing content-length limit on POST /messages/render allows denial-of-service via oversized requests

Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, the authenticated POST /messages/render endpoint renders the content parameter without enforcing the normal message length limit used by message send and edit operations. An authenticated user can submit...

PT-2026-137102

Zulip is an open-source team collaboration tool. From 8.0 until 12.2, in organizations where the Who can view all other users in the organization setting restricted guests from viewing other users, saving or editing a direct message draft did not verify that the sender could access the draft...

PT-2026-137103

Name of the Vulnerable Software and Affected Versions Zulip versions 11.0 through 12.1 Description Organizations with web-public channels enabled expose the 'GET /json/users' endpoint to unauthenticated spectators. A missing access-control check allows the include custom profile fields variable,...

PT-2026-137106

Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, the authenticated POST /messages/render endpoint renders the content parameter without enforcing the normal message length limit used by message send and edit operations. An authenticated user can submit...

CVE-2026-102893

Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, GenericOpenIdConnectBackend matches the identity provider email claim to an active account's deliveryemail without rejecting an explicitly false emailverified claim. If a configured identity provider returns a...

CVE-2026-100404

Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, guest users can receive new message events for public channels outside their subscriptions. A guest can trigger the issue by registering an event queue with parameters that request messages from an unsubscribe...

EUVD-2026-101288

Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, guest users can receive new message events for public channels outside their subscriptions. A guest can trigger the issue by registering an event queue with parameters that request messages from an unsubscribe...

CVE-2026-100404 Zulip: Guests can read new messages in non-subscribed public channels

Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, guest users can receive new message events for public channels outside their subscriptions. A guest can trigger the issue by registering an event queue with parameters that request messages from an unsubscribe...