CVE-2026-24050

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24050", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-20T22:30:11.778Z", "datePublished": "2026-02-06T18:20:33.160Z", "dateUpdated": "2026-02-09T15:28:55.237Z"}, "containers": {"cna": {"title": "Zulip affected by Stored XSS in user profile modal", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "baseScore": 1.1, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U", "version": "4.0"}}], "references": [{"name": "https://github.com/zulip/zulip/security/advisories/GHSA-56qv-8823-6fq9", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/zulip/zulip/security/advisories/GHSA-56qv-8823-6fq9"}, {"name": "https://github.com/zulip/zulip/commit/e6093d9e4788f4d82236d856c5ed7b16767886a7", "tags": ["x_refsource_MISC"], "url": "https://github.com/zulip/zulip/commit/e6093d9e4788f4d82236d856c5ed7b16767886a7"}, {"name": "https://github.com/zulip/zulip/releases/tag/11.5", "tags": ["x_refsource_MISC"], "url": "https://github.com/zulip/zulip/releases/tag/11.5"}, {"name": "https://zulip.readthedocs.io/en/latest/overview/changelog.html#zulip-server-11-5", "tags": ["x_refsource_MISC"], "url": "https://zulip.readthedocs.io/en/latest/overview/changelog.html#zulip-server-11-5"}], "affected": [{"vendor": "zulip", "product": "zulip", "versions": [{"version": ">= 5.0, < 11.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-06T18:20:33.160Z"}, "descriptions": [{"lang": "en", "value": "Zulip is an open-source team collaboration tool. From 5.0 to before 11.5, some administrative actions on the user profile were susceptible to stored XSS in group names or channel names. Exploiting these vulnerabilities required the user explicitly interacting with the problematic object. This vulnerability is fixed in 11.5."}], "source": {"advisory": "GHSA-56qv-8823-6fq9", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-09T15:19:33.800742Z", "id": "CVE-2026-24050", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-09T15:28:55.237Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24050", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-09T15:19:33.800742Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-09T15:19:34.625Z"}}], "cna": {"title": "Zulip affected by Stored XSS in user profile modal", "source": {"advisory": "GHSA-56qv-8823-6fq9", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 1.1, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "zulip", "product": "zulip", "versions": [{"status": "affected", "version": ">= 5.0, < 11.5"}]}], "references": [{"url": "https://github.com/zulip/zulip/security/advisories/GHSA-56qv-8823-6fq9", "name": "https://github.com/zulip/zulip/security/advisories/GHSA-56qv-8823-6fq9", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/zulip/zulip/commit/e6093d9e4788f4d82236d856c5ed7b16767886a7", "name": "https://github.com/zulip/zulip/commit/e6093d9e4788f4d82236d856c5ed7b16767886a7", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/zulip/zulip/releases/tag/11.5", "name": "https://github.com/zulip/zulip/releases/tag/11.5", "tags": ["x_refsource_MISC"]}, {"url": "https://zulip.readthedocs.io/en/latest/overview/changelog.html#zulip-server-11-5", "name": "https://zulip.readthedocs.io/en/latest/overview/changelog.html#zulip-server-11-5", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Zulip is an open-source team collaboration tool. From 5.0 to before 11.5, some administrative actions on the user profile were susceptible to stored XSS in group names or channel names. Exploiting these vulnerabilities required the user explicitly interacting with the problematic object. This vulnerability is fixed in 11.5."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-06T18:20:33.160Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24050", "state": "PUBLISHED", "dateUpdated": "2026-02-09T15:28:55.237Z", "dateReserved": "2026-01-20T22:30:11.778Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-06T18:20:33.160Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "zulip", "vendor": "zulip", "versions": [{"status": "affected", "version": ">= 5.0, < 11.5"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:zulip:zulip_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "6F93B1EC-F7D0-412E-A470-E58542B5E66C", "versionEndExcluding": "11.5", "versionStartIncluding": "5.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Zulip is an open-source team collaboration tool. From 5.0 to before 11.5, some administrative actions on the user profile were susceptible to stored XSS in group names or channel names. Exploiting these vulnerabilities required the user explicitly interacting with the problematic object. This vulnerability is fixed in 11.5."}, {"lang": "es", "value": "Zulip es una herramienta de colaboraci\u00f3n en equipo de c\u00f3digo abierto. Desde la versi\u00f3n 5.0 hasta antes de la 11.5, algunas acciones administrativas en el perfil de usuario eran susceptibles a XSS almacenado en nombres de grupos o nombres de canales. La explotaci\u00f3n de estas vulnerabilidades requer\u00eda que el usuario interactuara expl\u00edcitamente con el objeto problem\u00e1tico. Esta vulnerabilidad est\u00e1 corregida en la 11.5."}], "id": "CVE-2026-24050", "lastModified": "2026-06-17T10:22:31.390", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "UNREPORTED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24050", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-09T15:19:33.800742Z", "version": "2.0.3"}}]}, "published": "2026-02-06T19:16:08.640", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/zulip/zulip/commit/e6093d9e4788f4d82236d856c5ed7b16767886a7"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/zulip/zulip/releases/tag/11.5"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/zulip/zulip/security/advisories/GHSA-56qv-8823-6fq9"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://zulip.readthedocs.io/en/latest/overview/changelog.html#zulip-server-11-5"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T13:31:58.879377+00:00", "value": {"mitigation_remediation": ["Update Zulip Server to version 11.5 or later to obtain the vendor\u2011supplied patch", "Repeat the update process on any redundant or backup servers to ensure consistency across the deployment", "Sanitize existing group and channel names that may contain malicious scripts by removing or encoding special characters"], "summary": {"action": "Patch", "impact": "Client-side Stored XSS in user profile modal"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Zulip Server product from version 5.0 up to, but not including, 11.5. It is present in all intermediate releases within that range. The affected systems are servers running Zulip based on the Zulip open\u2011source distribution.", "description_and_impact": "Zulip\u2019s user profile modal stored malicious script data in group names or channel names when administrators edited user profiles. The script is stored in the server and rendered when the modal is opened, allowing a browser to execute injected code. This client\u2011side XSS can facilitate session hijacking, credential theft, or phishing attacks if a victim interacts with the affected modal. The weakness is identified as CWE\u201179.", "risk_and_exploitability": "The CVSS score of 1.1 reflects the low severity of this issue; the EPSS score of less than 1% indicates an extremely low probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog, suggesting no known large\u2011scale exploitation. Exploitation requires a user to open the profile modal and interact with the injected content, making it a user\u2011dependent attack vector with limited reach."}}}}, "created": "2026-02-09T10:49:43.476742+00:00", "updated": "2026-04-18T13:45:45.666227+00:00", "vendors": ["zulip", "zulip$PRODUCT$zulip"]}