Quick answers
- Is CVE-2026-115474 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-115474 being exploited in the wild.
- How severe is CVE-2026-115474?
- Medium severity, with a CVSS score of 6.5, published 4 November 2026.
- Which products and versions are affected?
- Zulip 8.0 to 12.1.
- Is there a fix for CVE-2026-115474?
- Yes: fixed in 12.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-115474 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-115474?
- Check whether you run Zulip at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 12.2
Technical details
The vulnerability stems from insufficient access control checks when saving or editing direct message drafts. The draft creation code calls recipient_for_user_profiles with create=True, which creates database subscriptions that are then incorrectly treated as granting access in check_can_access_user, allowing users restricted by can_access_all_users_group to access any user's profile by drafting a message to them. The fix adds check_sender_can_access_recipients before computing the recipient, aligning draft handling with the existing message-sending logic.
Affected products
- Zulip Zulip 8.0 to 12.1
Timeline
- 2026-11-04: disclosed