Custom profile fields can be read by logged-out visitors in organization with web-public channels

Impact

Organizations using the public access option let logged-out visitors see a limited user directory (names, avatars, roles, join dates). A missing access-control check let GET /json/users also honor include_custom_profile_fields for these visitors, so an unauthenticated request could retrieve every user's custom profile field values in addition to the limited data that was officially documented.

Workarounds

Disable spectator access (unset web-public on all channels, or turn off "Allow creating web-public channels").

Patches

Fixed in Zulip server 12.2