A missing access control check in Zulip versions before 11.6 allows anyone to retrieve attachments that were created in web‑public streams even after perpetrating disabling spectator access, and to query the "/users/me/<stream_id>/topics" endpoint anonymously. The flaw exposes the contents of those files and the full conversation history stored on public streams to unauthenticated parties. This is an authorization bypass (CWE‑862) that compromises confidentiality of user data rather than system integrity or availability.

All Zulip deployments running any release between 1.4.0 and 11.5.x are susceptible. The fix is integrated in version 11.6 and any installation of that version or newer is considered secure against this issue. The vulnerability impacts the Zulip collaboration platform regardless of the operating system or hosting model used.

The CVSS score of 5.3 indicates medium severity, and the EPSS score of less than 1% suggests a low probability of exploitation in the wild; the vulnerability is not present in the CISA KEV catalog. The likely attack vector is the act of an unauthenticated user sending straightforward HTTP GET requests to the affected attachment URLs or the "/users/me/<stream_id>/topics" endpoint. No special privileges or credentials are required, and the mechanism exploits a missing permission check on server‑side route handlers. While the impact is limited to leaking confidential data rather than executing code, the ease of access warrants prompt remediation.