An access‑control check was omitted from the GET /json/users endpoint in Zulip versions 11.0 through 12.2. When include_custom_profile_fields=true is supplied in an organization that has web‑public channels enabled, the response includes every user’s custom profile field values. This allows any visitor who is not logged in to read private profile information, resulting in a privacy breach. The underlying weakness is an improper authorization flaw (CWE-862).

The affected product is the Zulip collaboration server. Versions 11.0 up to and including 12.2 are vulnerable when the organization has public web channels enabled. The vulnerability applies to deployments where the /json/users endpoint is reachable by unauthenticated clients.

The CVSS score of 5.3 indicates moderate severity. There is no EPSS score available and the issue is not currently in the CISA KEV catalog. Given that the attack can be carried out by simply issuing an unauthenticated HTTP GET request to the endpoint, an attacker can obtain sensitive user data from any organization with public channels, representing a moderate but real privacy risk.