CVE-2026-24050

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-24050
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-24050.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-24050
Aliases
  • GHSA-56qv-8823-6fq9
Published
2026-02-06T18:20:33.160Z
Modified
2026-03-01T02:56:51.431889Z
Severity
  • 1.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U CVSS Calculator
Summary
Zulip affected by Stored XSS in user profile modal
Details

Zulip is an open-source team collaboration tool. From 5.0 to before 11.5, some administrative actions on the user profile were susceptible to stored XSS in group names or channel names. Exploiting these vulnerabilities required the user explicitly interacting with the problematic object. This vulnerability is fixed in 11.5.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24050.json"
}
References

Affected packages

Git / github.com/zulip/zulip

Affected ranges

Type
GIT
Repo
https://github.com/zulip/zulip
Events
Introduced
bf4f6544e70c83a5e105151d275e68aa04e7852e
Fixed
3ca9cefbb3a380c9563eb665940952e572a1fb60

Affected versions

10.*
10.0
10.0-beta1
10.0-beta2
10.0-dev
11.*
11.0
11.0-beta1
11.0-beta2
11.0-dev
11.1
11.2
11.3
11.4
5.*
5.0
5.0-dev
6.*
6.0
6.0-dev
7.*
7.0
7.0-beta3
7.0-dev
8.*
8.0
8.0-beta1
8.0-beta2
8.0-dev
9.*
9.0
9.0-beta1
9.0-dev
shared-0.*
shared-0.0.10
shared-0.0.11
shared-0.0.12
shared-0.0.13
shared-0.0.14
shared-0.0.15
shared-0.0.16
shared-0.0.17
shared-0.0.18
shared-0.0.6
shared-0.0.7
shared-0.0.8
shared-0.0.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-24050.json"