CVE-2026-24050

Опубликовано: 06 фев. 2026

Источник: nvd

CVSS3: 5.4

EPSS Низкий

Описание

Zulip is an open-source team collaboration tool. From 5.0 to before 11.5, some administrative actions on the user profile were susceptible to stored XSS in group names or channel names. Exploiting these vulnerabilities required the user explicitly interacting with the problematic object. This vulnerability is fixed in 11.5.

Ссылки

https://github.com/zulip/zulip/commit/e6093d9e4788f4d82236d856c5ed7b16767886a7
Patch
https://github.com/zulip/zulip/releases/tag/11.5
Release Notes
https://github.com/zulip/zulip/security/advisories/GHSA-56qv-8823-6fq9
Vendor Advisory
https://zulip.readthedocs.io/en/latest/overview/changelog.html#zulip-server-11-5
Release Notes

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:zulip:zulip_server:*:*:*:*:*:*:*:*

Версия от 5.0 (включая) до 11.5 (исключая)

EPSS

Процентиль: 2%

0.00014

Низкий

5.4 Medium

CVSS3

Дефекты

CWE-79

Связанные уязвимости