Answer in brief
CVE-2026-115574 records a Medium severity (CVSS 5.3) vulnerability in Zulip: Custom profile fields can be read by logged-out visitors in organization with web-public channels. The current sources do not mark it as known exploited. The current feed maps zulip/zulip (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps zulip/zulip (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| zulip/zulipgeneric | >=11.0 <12.2 | 12.2 |
Published upstream
Nov 4, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 4, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 4, 2026
Zulip is an open-source team collaboration tool. From 11.0 until 12.2, organizations with web-public channels enabled exposed the GET /json/users endpoint to logged-out spectators, and a missing access-control check allowed include_custom_profile_fields=true to return every user's custom profile field values in addition to the documented limited directory data. This exposed those custom profile field values to unauthenticated visitors. This issue is fixed in version 12.2.
Quoted source text, attributed separately from HOL analysis.