CVE-2026-24050

LOW EPSS 13.7%
Published Feb 6, 20264mo ago · Modified Jun 17, 20262w ago
1.1 CVSS 4.0
Low
Find Similar
Published Feb 6, 2026 4mo ago
Last Modified Jun 17, 2026 2w ago

Description

Zulip is an open-source team collaboration tool. From 5.0 to before 11.5, some administrative actions on the user profile were susceptible to stored XSS in group names or channel names. Exploiting these vulnerabilities required the user explicitly interacting with the problematic object. This vulnerability is fixed in 11.5.

CVSS Details

Base Score
1.1
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required High
User Interaction P
Scope X

Threat Intelligence

EPSS Exploit Probability
13.7% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-79 Cross-site Scripting Injection

Affected Products 1

VendorProductVersionRange
zulipzulip_server*≥5.0  –  <11.5

References 4

  • github.com https://github.com/zulip/zulip/commit/e6093d9e4788f4d82236d856c5ed7b16767886a7
    Patch
  • github.com https://github.com/zulip/zulip/releases/tag/11.5
    Release Notes
  • github.com https://github.com/zulip/zulip/security/advisories/GHSA-56qv-8823-6fq9
    Vendor Advisory
  • zulip.readthedocs.io https://zulip.readthedocs.io/en/latest/overview/changelog.html#zulip-server-11-5
    Release Notes

Remediation

  • github.com https://github.com/zulip/zulip/commit/e6093d9e4788f4d82236d856c5ed7b16767886a7
    Patch