PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-25742 zulip CVE debrief

CVE-2026-25742 is a vulnerability in Zulip, an open-source team collaboration tool. Even after disabling spectator access, attachments from web-public streams remain accessible anonymously. This issue, patched in version 11.6, allows retrieval of file contents and topic history for web-public streams without authentication. The vulnerability exists due to improper access controls on attachments and topic history for web-public streams in Zulip. Specifically, even after disabling spectator access (via enable_spectator_access or WEB_PUBLIC_STREAMS_ENABLED), attachments from web-public streams can still be retrieved anonymously. Additionally, the /users/me/<stream_id>/topics endpoint remains accessible without authentication, allowing retrieval of topic history for web-public streams.

Vendor
zulip
Product
Unknown
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-03
Original CVE updated
2026-07-24
Advisory published
2026-04-03
Advisory updated
2026-07-24

Who should care

Administrators and users of Zulip versions between 1.4.0 and 11.6 should be aware of this vulnerability. Disabling spectator access does not fully prevent anonymous access to certain stream data. Affected operator, platform, vulnerability-management, and security-team impact should be considered.

Technical summary

The vulnerability exists due to improper access controls on attachments and topic history for web-public streams in Zulip. Specifically, even after disabling spectator access (via enable_spectator_access or WEB_PUBLIC_STREAMS_ENABLED), attachments from web-public streams can still be retrieved anonymously. Additionally, the /users/me/<stream_id>/topics endpoint remains accessible without authentication, allowing retrieval of topic history for web-public streams.

Defensive priority

Medium priority for Zulip administrators and users, as the vulnerability allows for unauthorized access to sensitive information but does not allow for code execution or elevated privileges.

Recommended defensive actions

  • Upgrade to Zulip version 11.6 or later
  • Review and restrict access to web-public streams
  • Monitor for unauthorized access to stream data
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record was published on 2026-04-03T21:17:10.060Z and was last modified on 2026-07-24T22:10:00.140Z. The NVD entry is currently Analyzed. This information is based on the NVD entry and the CVE record. The vulnerability affects Zulip versions between 1.4.0 and 11.6. There are no known exploits, but defenders should verify the patch status of their deployments.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-25742 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-25742

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-25742 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-25742

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.