# CVE-2026-25742: Zulip missing authorization for anonymous access to attachments and topics

Source: https://junglewise.ai/threats/cve-2026-25742-zulip-missing-authorization-for-anonymous-access-to-attachments  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-03. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2026-25742 · Severity: medium · CVSS 5.3 · Published 2026-04-03

Zulip is an open-source team collaboration platform. A security flaw allowed unauthorized users to access files and chat topic histories even after administrators had disabled public 'spectator' access. This means that sensitive documents or conversation titles intended to be private could still be viewed by anyone on the internet without logging in.

Technologies: [Zulip](https://junglewise.ai/threats/technologies/zulip). Vendors: [Zulip](https://junglewise.ai/threats/vendors/zulip).

## Quick answers

**Is CVE-2026-25742 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-25742 being exploited in the wild.

**How severe is CVE-2026-25742?** Medium severity, with a CVSS score of 5.3, published 3 April 2026.

**Which products and versions are affected?** Zulip 1.4.0 to 11.5.

**Is there a fix for CVE-2026-25742?** A patch was published on 2026-03-31: Fixed in version 11.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-25742 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-25742?** Check whether you run Zulip at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A missing authorization check (CWE-862) in Zulip's attachment and topic history endpoints allows for unauthorized data retrieval. Specifically, the 'validate_attachment_request_for_spectator_access' function and the '/users/me/<stream_id>/topics' endpoint failed to verify the 'allow_web_public_streams_access()' realm setting. Consequently, even if an administrator disables spectator access (WEB_PUBLIC_STREAMS_ENABLED), files and topic metadata from previously public streams remain accessible to unauthenticated remote attackers via direct URL access. This issue was introduced in Zulip 5.0 and is patched in version 11.6.

## Affected products

- Zulip Zulip 1.4.0 to 11.5

## Timeline

- 2026-03-31: patched: Fixed in version 11.6
- 2026-04-03: disclosed: Initial NVD publication

## References

- [https://github.com/zulip/zulip/commit/3c045414299680b9f5dca7d76cf6cef6121c0236](https://github.com/zulip/zulip/commit/3c045414299680b9f5dca7d76cf6cef6121c0236)
- [https://github.com/zulip/zulip/commit/41e23347b5218b3b0397a55176c7d97396735bae](https://github.com/zulip/zulip/commit/41e23347b5218b3b0397a55176c7d97396735bae)
- [https://github.com/zulip/zulip/releases/tag/11.6](https://github.com/zulip/zulip/releases/tag/11.6)
- [https://github.com/zulip/zulip/security/advisories/GHSA-f47p-xjqq-g28w](https://github.com/zulip/zulip/security/advisories/GHSA-f47p-xjqq-g28w)

## Related threats

- [Zulip custom profile fields information disclosure](https://junglewise.ai/threats/cve-2026-115574-zulip-is-an-open-source-team-collaboration-tool-from-11-0-until)
- [Zulip authorization bypass in draft message handling](https://junglewise.ai/threats/cve-2026-115474-zulip-is-an-open-source-team-collaboration-tool-from-8-0-until)
- [Zulip Server path traversal in data import utility](https://junglewise.ai/threats/cve-2026-26058-zulip-server-path-traversal-in-data-import-utility)