Vulnerability · Published Feb 26, 2026 · Assigned by GitHub_M

CVE-2026-25741Zulip Vulnerable to Modification of Payment Method (Stripe Default Card) by Non-Billing Users

High 7.1

In plain English

A high-severity incorrect authorization in zulip from zulip. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.3%top 76.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Zulip is an open-source team collaboration tool. Prior to commit bf28c82dc9b1f630fa8e9106358771b20a0040f7, the API endpoint for creating a card update session during an upgrade flow was accessible to users with only organization member privileges. When the associated Stripe Checkout session is completed, the Stripe webhook updates the organization’s default payment method. Because no billing-specific authorization check is enforced, a regular (non-billing) member can change the organization’s payment method. This vulnerability affected the Zulip Cloud payment processing system, and has been patched as of commit bf28c82dc9b1f630fa8e9106358771b20a0040f7. Self-hosted deploys are no longer affected and no patch or upgrade is required for them.

Affected products (as reported)

Vendor	Product	Versions
zulip	zulip	< bf28c82dc9b1f630fa8e9106358771b20a0040f7

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

References

https://github.com/zulip/zulip/security/advisories/GHSA-vhhx-84f7-rc8j x_refsource_CONFIRM
https://github.com/zulip/zulip/commit/bf28c82dc9b1f630fa8e9106358771b20a0040f7 x_refsource_MISC