Incorrect authorization in Zulip Server - #VU162562
Published: November 9, 2026
Vulnerability details
The vulnerability allows a remote user to download files from a channel without being subscribed to it.
The vulnerability exists due to incorrect authorization in validate_attachment_request in zerver/lib/attachments.py when checking guest access to channel attachments. A remote user can request a known file URL using a guest account included, directly or through a user group, in the channel's "Who can subscribe to this channel" or "Who can subscribe anyone to this channel" permission to download the file without being subscribed to the channel.
For channels with protected history, access is limited to files from messages the guest received while subscribed. The vulnerability does not grant access to channel messages or reveal unknown file URLs.