What is the CVSS score of CVE-2026-25742?

CVE-2026-25742 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-25742?

Yes, a patch is available for CVE-2026-25742. Update the affected software to the latest version immediately.

Zulip CVE-2026-25742

EUVD-2026-18835 MEDIUM

Missing Authorization (CWE-862)

2026-04-03 GitHub_M

Authentication Bypass Zulip

5.3

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

11.6

EUVD ID Assigned

Apr 03, 2026 - 20:45 euvd

EUVD-2026-18835

Analysis Generated

Apr 03, 2026 - 20:45 vuln.today

CVE Published

Apr 03, 2026 - 20:12 nvd

MEDIUM 5.3

DescriptionCVE.org

Zulip is an open-source team collaboration tool. Prior to version 11.6, Zulip is an open-source team collaboration tool. From version 1.4.0 to before version 11.6, even after spectator access (enable_spectator_access / WEB_PUBLIC_STREAMS_ENABLED) is disabled, attachments originating from web-public streams can still be retrieved anonymously. As a result, file contents remain accessible even after public access is intended to be disabled. Similarly, even after spectator access is disabled, the /users/me/<stream_id>/topics endpoint remains reachable anonymously, allowing retrieval of topic history for web-public streams. This issue has been patched in version 11.6. This issue has been patched in version 11.6.

AnalysisAI

Zulip versions 1.4.0 through 11.5 allow unauthenticated retrieval of attachments and topic history from web-public streams even after spectator access is disabled, due to incomplete access control on attachment serving and the /users/me/<stream_id>/topics endpoint. An attacker can bypass intended access restrictions to read file contents and stream metadata after public access is supposed to be revoked. The vulnerability affects all Zulip deployments that previously enabled spectator access and then disabled it. Vendor-released patch: version 11.6.

Technical ContextAI

Zulip's spectator access feature (enable_spectator_access / WEB_PUBLIC_STREAMS_ENABLED) is designed to allow temporary public visibility of streams and attachments. The vulnerability stems from improper revocation logic in CWE-862 (Missing Authorization): when administrators disable spectator access, the application fails to enforce authentication checks on two critical endpoints - the attachment retrieval mechanism and the /users/me/<stream_id>/topics endpoint. These endpoints retain anonymous accessibility because the application does not verify that the user making the request has legitimate access to the stream in question. The CPE cpe:2.3:a:zulip:zulip:*:*:*:*:*:*:*:* indicates all Zulip product versions are in scope, though the vulnerability manifests only in versions 1.4.0 through 11.5 where this access control logic was first introduced and remained incomplete.

RemediationAI

Vendor-released patch: upgrade to Zulip version 11.6 or later. This version restores proper authentication enforcement on attachment retrieval and the /users/me/<stream_id>/topics endpoint when spectator access is disabled. Administrators should prioritize this upgrade if they have previously used or currently use spectator access features. No interim workaround is documented; the only mitigation prior to patching is to avoid disabling spectator access if public streams must remain confidential, or to prevent unauthorized API access through network-level controls. For more details, see the release notes at https://github.com/zulip/zulip/releases/tag/11.6 and the upstream fix commits at https://github.com/zulip/zulip/commit/3c045414299680b9f5dca7d76cf6cef6121c0236 and https://github.com/zulip/zulip/commit/41e23347b5218b3b0397a55176c7d97396735bae.