CVE-2026-24050

low-risk

Published 2026-02-06

Zulip is an open-source team collaboration tool. From 5.0 to before 11.5, some administrative actions on the user profile were susceptible to stored XSS in group names or channel names. Exploiting these vulnerabilities required the user explicitly interacting with the problematic object. This vulnerability is fixed in 11.5.

Do I need to act?

0.02% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.4/10 Medium

NETWORK / LOW complexity

Affected Products (1)

Zulip Server

Affected Vendors

Zulip

References (4)

Patch https://github.com/zulip/zulip/commit/e6093d9e4788f4d82236d856c5ed7b16767886a7

Release Notes https://github.com/zulip/zulip/releases/tag/11.5

Vendor Advisory https://github.com/zulip/zulip/security/advisories/GHSA-56qv-8823-6fq9

Release Notes https://zulip.readthedocs.io/en/latest/overview/changelog.html#zulip-server-11-5

/ 100

low-risk

Severity 21/34 · High

Exploitability 0/34 · Minimal

Exposure 5/34 · Minimal