zulip

Products

Exploited and recent CVEs

• CVE-2026-115474 Medium 6.5 Zulip: Saving a draft DM to a user bypasses can_access_all_users_group permission 0.3%
• CVE-2026-115574 Medium 5.3 Zulip: Custom profile fields can be read by logged-out visitors in organization with web-public channels 0.7%
• CVE-2026-97701 Medium 6.5 Zulip: Missing content-length limit on POST /messages/render allows denial-of-service via oversized requests 0.4%
• CVE-2026-100404 Medium 6.5 Zulip: Guests can read new messages in non-subscribed public channels 0.4%
• CVE-2026-102893 Critical 9.1 Zulip: OpenID Connect authentication ignores the email_verified claim 0.4%
• CVE-2026-40300 Medium 6.0 Zulip: Message edit history visible in "moves only" policy through /api/v1/messages/{id}/history 0.2%
• CVE-2026-26058 Medium 6.1 Zulip: Path Traversal in Import 0.2%
• CVE-2026-25742 Medium 5.3 Zulip: Anonymous File Access After Disabling Spectator Access 0.3%
• CVE-2026-25741 High 7.1 Zulip Vulnerable to Modification of Payment Method (Stripe Default Card) by Non-Billing Users 0.3%
• CVE-2026-24050 Low 1.1 Zulip affected by Stored XSS in user profile modal 0.3%
• CVE-2025-52559 Medium 6.8 Zulip XSS in digest preview URL 0.3%
• CVE-2025-47930 Medium 5.3 Zulip Server has access control bypass for restrictions on creation of specific channel types 0.4%
• CVE-2025-31478 High 8.2 Zulip Authentication Backend Configuration Bypass 0.4%
• CVE-2025-30369 Low 2.7 Zulip allows the deletion of Custom profile fields by administrators of a different organization 0.3%
• CVE-2025-30368 Low 2.7 Zulip allows the deletion of organization by administrators of a different organization 0.3%
• CVE-2025-27149 Medium 4.6 Zulip exports can leak private data 0.3%
• CVE-2025-25195 Medium 4.3 Zulip events can leak private channel names 0.4%
• CVE-2024-56136 Medium 6.9 /api/v1/jwt/fetch_api_key endpoint can leak if an email address has an account in Zulip server 0.6%
• CVE-2024-27286 Medium 6.5 Moving single messages from public to private streams leaves them accessible 0.5%
• CVE-2024-21630 Medium 4.3 Zulip non-admins can invite new users to streams they would not otherwise be able to add existing users to 0.4%
• CVE-2023-47642 Medium 4.3 Stream description leaks to ex-subscribers in Zulip 0.5%
• CVE-2023-32678 Medium 6.5 Zulip vulnerable to insufficient authorization check for edition/deletion of messages and topics in private streams by former subscribers 0.5%
• CVE-2023-33186 High 8.2 Cross-site scripting vulnerability in Zulip Server development branch via topic tooltip 0.6%
• CVE-2023-28623 Medium 6.5 Unauthorized user can register an account in specific configurations in Zulip 0.5%
• CVE-2023-32677 Low 3.1 Users who can send invitations can erroneously add users to streams during invitation in Zulip 0.6%
• CVE-2023-22735 Medium 4.4 User uploads proxied from S3 lack `Content-Security-Policy` headers, may be served with `Content-Disposition: inline` in zulip 0.5%
• CVE-2022-41914 Low 3.7 Non-constant-time SCIM token comparison in Zulip Server 0.6%
• CVE-2022-36048 Medium 4.3 IP address leak via image proxy bypass in Zulip Server 0.6%
• CVE-2022-35962 High 8.0 Crafted link in Zulip message can cause disclosure of credentials 1.1%
• CVE-2022-31168 Medium 5.4 Zulip Server insufficient authorization for changing bot roles 0.8%