SB2026081129 - Multiple vulnerabilities in Zulip Server

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026081129

SB2026081129 - Multiple vulnerabilities in Zulip Server

Published: August 11, 2026

Security Bulletin ID SB2026081129
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 20% Low 80%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 vulnerabilities.


1) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper access control in the GET /json/users endpoint when handling requests with include_custom_profile_fields for logged-out visitors. A remote attacker can send a specially crafted request to disclose sensitive information.

Only organizations using the public access option with web-public channels are vulnerable.


2) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose profile information of other users.

The vulnerability exists due to improper access control in direct message draft saving when handling draft recipients. A remote user can save a direct message draft with recipients they are not allowed to access to disclose profile information of other users.

Only organizations that restrict guests\' ability to view other users using the relevant organization setting are vulnerable.


3) Improper Authentication (CVE-ID: N/A)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to authenticate as another user.

The vulnerability exists due to improper authentication in GenericOpenIdConnectBackend account lookup when processing OpenID Connect login responses. A remote user can authenticate with an unverified email claim matching another active account to authenticate as another user.

Exploitation depends on the identity provider returning an email value not actually owned by the authenticating user together with email_verified=false.


4) Input validation error (CVE-ID: N/A)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper input validation in POST /messages/render when rendering user-supplied Markdown content. A remote user can send an oversized request to cause a denial of service.

Repeated or concurrent requests from a single account can degrade backend availability for other users.


5) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in the event queue handling for public channel messages when registering an event queue with appropriate parameters or using an existing event queue after channel access was removed. A remote user can receive events for new messages in non-subscribed public channels to disclose sensitive information.


Remediation

Install update from vendor's website.

References