Medium severity · published Feb 6, 2026
CVE-2026-24050
Zulip affected by Stored XSS in user profile modal
5.4
CVSS
0.3%
EPSS
No
On KEV
Description
Zulip is an open-source team collaboration tool. From 5.0 to before 11.5, some administrative actions on the user profile were susceptible to stored XSS in group names or channel names. Exploiting these vulnerabilities required the user explicitly interacting with the problematic object. This vulnerability is fixed in 11.5.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 19% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ZU
zulip · zulip
>= 5.0, < 11.5 · source: vendor
ZS
Zulip Server · Zulip
5.0 before 11.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-24050
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-24050
Patch
https://github.com/zulip/zulip/commit/e6093d9e4788f4d82236d856c5ed7b16767886a7
Release Notes
https://github.com/zulip/zulip/releases/tag/11.5
Vendor Advisory
https://github.com/zulip/zulip/security/advisories/GHSA-56qv-8823-6fq9
Release Notes
https://zulip.readthedocs.io/en/latest/overview/changelog.html#zulip-server-11-5
More from zulip
9.8
CVE-2022-21706
Multi-use invitations can grant access to other organizations in Zulip
9.8
CVE-2021-43799
RabbitMQ exposes ports with weak default secrets in Zulip Server
9.1
CVE-2026-102893
Zulip: OpenID Connect authentication ignores the email_verified claim
8.8
CVE-2022-31168
Zulip Server insufficient authorization for changing bot roles
8.8
CVE-2021-3967
Improper Access Control in zulip/zulip