Zulip from versions 8.0 up to 12.2 allowed a guest user to save or edit a Direct Message (DM) draft targeting a user in the same organization without verifying that the sender could legitimately access the recipient’s information. Because this action did not perform the usual permission check, a guest privileged user could read restricted users’ profile data without ever sending a message. The flaw manifests as an authorization bypass (CWE‑862) that permits accidental disclosure of confidential internal information.

The vulnerability affects the Zulip server product. All deployments that include Zulip versions 8.0 through 12.1 are impacted. Version 12.2 includes a fix that restores the proper permission validation. Organizations that do not enable the “restrict guests from viewing other users” setting are unaffected, as the defect only manifests when that setting is active.

The CVSS base score of 6.5 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no current known widespread exploitation. Attackers can exploit the flaw from within the application by logging in as a guest user and creating a DM draft to a restricted user; no external network access is required. Consequently, the risk is limited to environments where guests have be allowed to view other users, and the impact is primarily confidentiality exposure of restricted users’ profile information.