Vulnerability · Published Mar 31, 2025 · Assigned by GitHub_M

CVE-2025-30369Zulip allows the deletion of Custom profile fields by administrators of a different organization

Low 2.7

In plain English

A low-severity security flaw in zulip from zulip. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).

Severity (CVSS 3.1)2.7Low

Exploit odds (30 days)0.3%top 79.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Zulip is an open-source team collaboration tool. The API for deleting an organization custom profile field is supposed to be restricted to organization administrators, but its handler failed to check that the field belongs to the same organization as the user. Therefore, an administrator of any organization was incorrectly allowed to delete custom profile fields belonging to a different organization. This is fixed in Zulip Server 10.1.

Affected products (as reported)

Vendor	Product	Versions
zulip	zulip	>= 1.6.0, < 10.1

Weakness: CWE-566 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

References

https://github.com/zulip/zulip/security/advisories/GHSA-fcgx-q63f-7gw4 x_refsource_CONFIRM