Vulnerability · Published Mar 31, 2025 · Assigned by GitHub_M

CVE-2025-30368Zulip allows the deletion of organization by administrators of a different organization

Low 2.7

In plain English

A low-severity security flaw in zulip from zulip. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 29% of all known vulnerabilities).

Severity (CVSS 3.1)2.7Low

Exploit odds (30 days)0.3%top 71.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Zulip is an open-source team collaboration tool. The API for deleting an organization export is supposed to be restricted to organization administrators, but its handler failed to check that the field belongs to the same organization as the user. Therefore, an administrator of any organization was incorrectly allowed to delete an export of a different organization. This is fixed in Zulip Server 10.1.

Affected products (as reported)

Vendor	Product	Versions
zulip	zulip	>= 10.0-beta1, < 10.1

Weakness: CWE-566 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

References

https://github.com/zulip/zulip/security/advisories/GHSA-rmhr-5ffq-qcrc x_refsource_CONFIRM
https://github.com/zulip/zulip/commit/07dcee36b2a34d63429d7a706f880628cf3433df x_refsource_MISC
https://zulip.readthedocs.io/en/latest/overview/changelog.html#zulip-server-10-1 x_refsource_MISC