Vulnerability · Published Apr 3, 2026 · Assigned by GitHub_M

CVE-2026-25742Zulip: Anonymous File Access After Disabling Spectator Access

Medium 5.3

In plain English

A medium-severity missing authorization in zulip from zulip. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.3%top 74.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Zulip is an open-source team collaboration tool. Prior to version 11.6, Zulip is an open-source team collaboration tool. From version 1.4.0 to before version 11.6, even after spectator access (enable_spectator_access / WEB_PUBLIC_STREAMS_ENABLED) is disabled, attachments originating from web-public streams can still be retrieved anonymously. As a result, file contents remain accessible even after public access is intended to be disabled. Similarly, even after spectator access is disabled, the /users/me/<stream_id>/topics endpoint remains reachable anonymously, allowing retrieval of topic history for web-public streams. This issue has been patched in version 11.6. This issue has been patched in version 11.6.

Affected products (as reported)

Vendor	Product	Versions
zulip	zulip	< 11.6

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/zulip/zulip/security/advisories/GHSA-f47p-xjqq-g28w x_refsource_CONFIRM
https://github.com/zulip/zulip/commit/3c045414299680b9f5dca7d76cf6cef6121c0236 x_refsource_MISC
https://github.com/zulip/zulip/commit/41e23347b5218b3b0397a55176c7d97396735bae x_refsource_MISC
https://github.com/zulip/zulip/releases/tag/11.6 x_refsource_MISC