CVE-2021-39911

What it actually does

An authorization bypass that leaks private email addresses of issue and merge request assignees into webhook payloads sent to external consumers.

Why it matters to the business

Organizations risk unintended disclosure of employee contact details to integrated third-party services, raising privacy and regulatory compliance concerns with low urgency due to the absence of known exploitation or ransomware use.

How an attack unfolds

An attacker registers a webhook endpoint, assigns an issue or merge request to a user whose email is marked private, and receives the email address embedded in the delivered webhook data without additional authentication.

How to fix it

Upgrade affected installations to the patched versions listed for zulip/zulip, specifically applying the fix at commit d5db254ca8167995a1654d1c45ffc74b2fade39a.

How to confirm the fix worked

After upgrade, inspect sample webhook payloads to confirm private assignee emails are no longer present and review webhook configuration settings for proper access controls.

Typical attack path

1. Register or control a webhook consumer endpoint
2. Create or modify an issue or merge request and assign it to a target user
3. Trigger the webhook event through normal activity
4. Inspect the received payload to extract the leaked private email address

How to detect it

Examine webhook delivery logs and payload archives for unexpected inclusion of email addresses; correlate with assignment events in issue or merge request activity logs.

What your security team should do

• Apply the listed fixed commit or equivalent patch promptly on all instances using webhooks
• Audit existing webhooks to identify any that may receive sensitive assignee data
• Restrict webhook consumers to trusted endpoints only until remediation is complete