Custom profile fields can be read by logged-out visitors in organization with web-public channels
Summary
Impact
Organizations using the public access option let logged-out visitors see a limited user directory (names, avatars, roles, join dates). A missing access-control check let GET /json/users also honor include_custom_profile_fields for thes...
Original description The description as published by the source.
Impact
Organizations using the public access option let logged-out visitors see a limited user directory (names, avatars, roles, join dates). A missing access-control check let GET /json/users also honor include_custom_profile_fields for these visitors, so an unauthenticated request could retrieve every user's custom profile field values in addition to the limited data that was officially documented.
Workarounds
Disable spectator access (unset web-public on all channels, or turn off "Allow creating web-public channels").
Patches
Fixed in Zulip server 12.2
Source: GitHub Repository Security Advisories (Game のスタック) GitHub Advisory OSV
References
- GITHUB_REPO_ADVISORY zulip/zulip