CVE-2026-115474 json
Zulip: Saving a draft DM to a user bypasses can_access_all_users_group permission
published 2026-11-04 4 d ago modified 2026-11-06 2 d ago also EUVD-2026-117034
- cvss
- 6.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 26%
- public exploits
- 0
- none known
Summary
Zulip is an open-source team collaboration tool. From 8.0 until 12.2, in organizations where the Who can view all other users in the organization setting restricted guests from viewing other users, saving or editing a direct message draft did not verify that the sender could access the draft recipients. A guest could thereby gain access to otherwise restricted users' profile information without sending a message. Organizations that did not restrict guest access were unaffected. This issue is fixed in version 12.2.
Patch / fix
- github.com/zulip/zulip@1127d4c commit
- github.com/zulip/zulip@83a4a3a commit
- github.com/zulip/zulip#39913 pull request
- github.com/zulip/zulip/releases/tag/12.2 release
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 3 d ago
Exploit prediction
0.33% chance of exploitation in the next 30 days, higher than 26% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Affected products
- zulip zulip
Classification
- Weakness
-
- CWE-862 Missing Authorization
References
- github.com /zulip/zulip/pull/39913
- github.com /zulip/zulip/commit/1127d4cd3cc17a3cc38435ce57ed52b083c33f97
- github.com /zulip/zulip/commit/83a4a3a966e6eef11914b80f04426ae114a1970d
- github.com /zulip/zulip/security/advisories/GHSA-vwqp-7j32-xfg5
- github.com /zulip/zulip/releases/tag/12.2
- zulip.readthedocs.io /en/latest/overview/changelog.html#zulip-server-12-2
Sources
- CVE List CVE-2026-115474
- NVD CVE-2026-115474
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.