CVE-2026-25742

Zulip is an open-source team collaboration tool. Prior to version 11.6, Zulip is an open-source team collaboration tool. From version 1.4.0 to before version 11.6, even after spectator access (enable_spectator_access / WEB_PUBLIC_STREAMS_ENABLED) is disabled, attachments originating from web-public streams can still be retrieved anonymously. As a result, file contents remain accessible even after public access is intended to be disabled. Similarly, even after spectator access is disabled, the /users/me/<stream_id>/topics endpoint remains reachable anonymously, allowing retrieval of topic history for web-public streams. This issue has been patched in version 11.6. This issue has been patched in version 11.6.

• CWE-862

• https://github.com/zulip/zulip/commit/3c045414299680b9f5dca7d76cf6cef6121c0236Patch
• https://github.com/zulip/zulip/commit/41e23347b5218b3b0397a55176c7d97396735baePatch
• https://github.com/zulip/zulip/releases/tag/11.6Release Notes
• https://github.com/zulip/zulip/security/advisories/GHSA-f47p-xjqq-g28wExploit, Vendor Advisory
• https://github.com/zulip/zulip/security/advisories/GHSA-f47p-xjqq-g28wExploit, Vendor Advisory

Published

Apr 3, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-25736Rucio is a software framework that provides functionality to…4.8
• CVE-2026-25737Budibase is a low code platform for creating internal tools,…9
• CVE-2026-25738Indico is an event management system that uses Flask-Multipa…4.3
• CVE-2026-25739Indico is an event management system that uses Flask-Multipa…5.4
• CVE-2026-25740captive browser, a dedicated Chrome instance to log into cap…5.8
• CVE-2026-25741Zulip is an open-source team collaboration tool. Prior to co…7.1
• CVE-2026-25743OpenEMR is a free and open source electronic health records …4.8
• CVE-2026-25744OpenEMR is a free and open source electronic health records …6.5
• CVE-2026-25745OpenEMR is a free and open source electronic health records …6.5
• CVE-2026-25746OpenEMR is a free and open source electronic health records …8.8
• CVE-2026-25747Deserialization of Untrusted Data vulnerability in Apache Ca…8.8
• CVE-2026-25748authentik is an open-source identity provider. Prior to 2025…7.5