CVE-2026-115574 | Zulip up to 12.1 Users Endpoint include_custom_profile_fields access control

November 4, 2026 Yanac

A vulnerability classified as problematic was found in Zulip up to 12.1. Impacted is an unknown function of the component Users Endpoint. The manipulation of the argument include_custom_profile_fields results in improper access controls.

This vulnerability is reported as CVE-2026-115574. The attack can be launched remotely. No exploit exists.

Upgrading the affected component is advised.VulDB Recent EntriesRead More