Exposure of Private Information ('Privacy Violation') in Zulip Server - #VU162565
Published: November 9, 2026
Vulnerability details
The vulnerability allows a remote privileged user to obtain private direct messages from conversations involving deleted users, including messages from participants who have not consented to exporting their private data.
The vulnerability exists due to improper export consent checks in the get_consented_user_ids function in zerver/lib/export.py when generating organization exports of public and private data with member consent. Deleted accounts are converted into mirror dummy accounts, which are treated as consenting regardless of their export consent settings. A remote privileged user can generate an organization export to obtain direct message conversations involving those accounts, including messages from other participants who have not consented.