---
id: CVE-2026-25742
title: Zulip is an open-source team collaboration tool
summary: >-
  Zulip is an open-source team collaboration tool. Prior to version 11.6, Zulip
  is an open-source team collaboration tool. From version 1.4.0 to before
  version 11.6, even after spectator access (enable_spectator_access /
  WEB_PUBLIC_STREAMS…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-862
vendor: zulip
product: zulip
affected:
  - 'zulip >= 1.4.0, < 11.6'
patched:
  - zulip 11.6
published: '2026-04-03'
updated: '2026-07-24'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-25742'
references:
  - url: >-
      https://github.com/zulip/zulip/commit/3c045414299680b9f5dca7d76cf6cef6121c0236
    label: security-advisories@github.com
  - url: >-
      https://github.com/zulip/zulip/commit/41e23347b5218b3b0397a55176c7d97396735bae
    label: security-advisories@github.com
  - url: 'https://github.com/zulip/zulip/releases/tag/11.6'
    label: security-advisories@github.com
  - url: 'https://github.com/zulip/zulip/security/advisories/GHSA-f47p-xjqq-g28w'
    label: security-advisories@github.com
  - url: 'https://github.com/zulip/zulip/security/advisories/GHSA-f47p-xjqq-g28w'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00446
epssPercentile: 0.36081
ingestedAt: '2026-07-25T22:05:04.801Z'
---

## Overview

Zulip is an open-source team collaboration tool. Prior to version 11.6, Zulip is an open-source team collaboration tool. From version 1.4.0 to before version 11.6, even after spectator access (enable_spectator_access / WEB_PUBLIC_STREAMS_ENABLED) is disabled, attachments originating from web-public streams can still be retrieved anonymously. As a result, file contents remain accessible even after public access is intended to be disabled. Similarly, even after spectator access is disabled, the /users/me/<stream_id>/topics endpoint remains reachable anonymously, allowing retrieval of topic history for web-public streams. This issue has been patched in version 11.6. This issue has been patched in version 11.6.

## Affected

- `zulip >= 1.4.0, < 11.6`

## Remediation

Upgrade past the affected range:

- `zulip 11.6`