CVE-2026-115474 · Package
NO FIX YET · SEE WHAT TO DO
Zulip versions 8.0 through 12.1 failed to check whether a guest could access the recipients of a direct message draft when saving or editing it. A guest in an organization that restricts who can view other users could read those restricted users' profile information without sending a message.
first public Aug 10, 2026 · 1 source
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Self-hosted or managed Zulip servers from 8.0 up to 12.1 where guests are restricted from viewing other users. Organizations that did not restrict guest access were not affected.
Not affected if guest-access-unrestricted, version-12.2-or-later
Who cares guests, self-hosted, zulip
12.2.Zulip is an open-source team collaboration tool. From 8.0 until 12.2, in organizations where the Who can view all other users in the organization setting restricted guests from viewing other users, saving or editing a direct message draft did not verify that the sender could access the draft recipients. A guest could thereby gain access to otherwise restricted users' profile information without sending a message. Organizations that did not restrict guest access were unaffected. This issue is fixed in version 12.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-115474") · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.