12.2
Zulip Server 12.2
Changed 1
- Mattermost imports are considerably faster
Fixed 2
- Mattermost import tool now correctly preserves text that resembles an HTML tag such as </rant> or <username> in imported messages
- Fixed crashes in some database migrations that run when upgrading from Zulip 11.x
Security 5
- Guest users could receive new messages sent to public channels they were not subscribed to by registering an event queue with appropriate parameters, and existing event queues continued to deliver such messages after a guest lost access to the channel
- Insufficient access checks in message draft creation allowed a guest to gain access to the profile information of any other user in organizations that limit which users guests can see
- In organizations with web-public channels enabled, logged-out visitors could read the custom profile field values of every user in the organization
- The OpenID Connect authentication backend did not consult the email_verified claim, allowing a misconfigured identity provider to log a user into an account belonging to someone else
- The message rendering endpoint did not enforce the message content length limit, allowing an authenticated user to consume excessive server resources
Released 2026-08-10
- GHSA-5r8f-gq2h-fcgp: Guest users could receive new messages sent to public channels they were not subscribed to, by registering an event queue with appropriate parameters. Existing event queues also continued to deliver such messages after a guest lost access to the channel. This vulnerability was discovered in an internal audit, and independently reported by Anthony Green of GreenHat Security.
- GHSA-vwqp-7j32-xfg5: Insufficient access checks in message draft creation allowed a guest to gain access to the profile information of any other user in the organization. This issue only impacted organizations that limit which users guests can see. This vulnerability was reported by @JebeenLee.
- GHSA-3m37-hwq6-jrj8: In organizations with web-public channels enabled, logged-out visitors could read the custom profile field values of every user in the organization. This vulnerability was reported by Jaeyoon Kim (@jaeyoon-kim-dev) of System Security Lab, SKKU.
- GHSA-xw9h-9rcm-hx4m: The OpenID Connect authentication backend did
not consult the
email_verifiedclaim, so a misconfigured identity provider sending an untrustedemailclaim withemail_verified=falsecould log a user into an account belonging to someone else. This vulnerability was reported by @JebeenLee. - GHSA-m257-w4r5-5rmf: The message rendering endpoint
(
POST /json/messages/render) did not enforce the message content length limit, allowing an authenticated user to consume excessive server resources. This vulnerability was reported by @Team-Atlanta. - Fixed the Mattermost import tool silently discarding text that
resembles an HTML tag (e.g.,
</rant>or<username>) from imported messages. Mattermost imports are also considerably faster as a result of this change. - Fixed crashes in some database migrations that run when upgrading from Zulip 11.x.