PT-2026-6771 · Zulip · Zulip

Joshua Rogers · Published 2026-02-06 · Updated 2026-02-06 · CVE-2026-24050

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Zulip versions 5.0 through 11.4

Description Zulip, an open-source team collaboration tool, had a stored cross-site scripting (XSS) issue in group names or channel names due to certain administrative actions on the user profile. Exploitation required user interaction with the affected object.

Recommendations Update to version 11.5 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-24050

GHSA-56QV-8823-6FQ9

Affected Products

Zulip

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24050.json · Exploit
• https://github.com/zulip/zulip/security/advisories/GHSA-56qv-8823-6fq9 · Vendor Advisory
• https://github.com/zulip/zulip/commit/e6093d9e4788f4d82236d856c5ed7b16767886a7 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-24050 · Security Note
• https://osv.dev/vulnerability/CVE-2026-24050 · Vendor Advisory
• https://github.com/zulip/zulip/releases/tag/11.5 · Note
• https://zulip.readthedocs.io/en/latest/overview/changelog.html#zulip-server-11-5 · Note
• https://twitter.com/CVEnew/status/2019847318099386370 · Twitter Post