Missing access check in typing endpoint exposed inaccessible users' IDs and emails

Impact

In organizations that limit which users a guest can see, the direct-message typing notification endpoint failed to apply the recipient access checks that sending an actual direct message enforces. A guest could therefore address a typing notification to a user they were not permitted to access, and because the server echoes the notification's recipient list back to the sender, confirm that user's existence and learn identifying information about them (their user ID, and, depending on the organization's email visibility setting, possibly their email address). Exploiting the issue required an authenticated guest account in an affected organization.

The impact was limited in the following ways:

• In the majority of organizations, which don't enable the setting for limiting which users a guest can see, this bug had no impact, as all users can see each other anyway.
• Users who restrict the visibility of their email address, wouldn't have their email address leaked due to the above bug - only the dummy email in the form user@ would be leaked. Only users who set Who can access user’s email address. to Admins, moderators, members and guests would have their email address revealed.

Patches

Fixed in Zulip server 12.3

References

Setting for restricting whether guests can see other users: https://zulip.com/help/guest-users#configure-whether-guests-can-see-all-other-users
Setting for configuring email visiblity: https://zulip.com/help/configure-email-visibi…