CVE-2024-56136

Zulip Server 7.0 and above are affected by an information disclosure vulnerability that allows an unauthenticated attacker to determine whether an email address exists for a user on a server hosting multiple organizations (CVE-2024-56136). The issue is resolved in Zulip Server 9.4 and in the main...

Zulip server 信息泄露漏洞

Zulip server is an open source team chat application from Zulip, Inc. in the United States. An information disclosure vulnerability exists in Zulip server versions 7.0 through prior to 9.4, which stems from susceptibility to an information disclosure attack in which an unauthenticated user could...

CVE-2024-56136: Exposure of Sensitive Information to an Unauthorized Actor

Zulip server provides an open-source team chat that helps teams stay productive and focused. Zulip Server 7.0 and above are vulnerable to an information disclose attack, where, if a Zulip server is hosting multiple organizations, an unauthenticated user can make a request and determine if an emai...

PT-2025-3194

Name of the Vulnerable Software and Affected Versions Zulip Server versions 7.0 through 9.3 Description The issue concerns an information disclosure attack where an unauthenticated user can determine if an email address is in use by a user on a Zulip server hosting multiple organizations. There a...

CVE-2024-27286 Moving single messages from public to private streams leaves them accessible

Zulip is an open-source team collaboration tool. When a user moves a Zulip message, they have the option to move all messages in the topic, move only subsequent messages as well, or move just a single message. If the user chose to just move one message, and was moving it from a public stream to a...

CVE-2024-27286: Exposure of Sensitive Information to an Unauthorized Actor

Zulip is an open-source team collaboration tool. When a user moves a Zulip message, they have the option to move all messages in the topic, move only subsequent messages as well, or move just a single message. If the user chose to just move one message, and was moving it from a public stream to a...

PT-2023-23954

Name of the Vulnerable Software and Affected Versions Zulip Server versions prior to 7.3 Description Zulip is an open-source team collaboration tool with topic-based threading that combines email and chat. Users who used to be subscribed to a private stream and have been removed from it since...

CVE-2023-33186 Cross-site scripting vulnerability in Zulip Server development branch via topic tooltip

Zulip is an open-source team collaboration tool with unique topic-based threading that combines the best of email and chat to make remote work productive and delightful. The main development branch of Zulip Server from May 2, 2023 and later, including beta versions 7.0-beta1 and 7.0-beta2, is...

CVE-2023-33186

Zulip is an open-source team collaboration tool with unique topic-based threading that combines the best of email and chat to make remote work productive and delightful. The main development branch of Zulip Server from May 2, 2023 and later, including beta versions 7.0-beta1 and 7.0-beta2, is...

CVE-2023-33186

CVE-2023-33186 affects Zulip Server: main development branch (from May 2, 2023) and beta releases 7.0-beta1/beta2. The issue is a cross-site scripting (XSS) vulnerability in tooltips on the message feed. If an attacker can send messages, they could craft a topic such that hovering the tooltip in ...

CVE-2023-33186 Cross-site scripting vulnerability in Zulip Server development branch via topic tooltip

Zulip is an open-source team collaboration tool with unique topic-based threading that combines the best of email and chat to make remote work productive and delightful. The main development branch of Zulip Server from May 2, 2023 and later, including beta versions 7.0-beta1 and 7.0-beta2, is...

PT-2023-24203 · Unknown · Zulip Server

Name of the Vulnerable Software and Affected Versions: Zulip Server versions 7.0-beta1 through 7.0-beta2 and the main development branch from May 2, 2023 and later Description: The issue is related to a cross-site scripting vulnerability in tooltips on the message feed. An attacker who can send...

CVE-2023-32677

Zulip is an open-source team collaboration tool with unique topic-based threading. Zulip administrators can configure Zulip to limit who can add users to streams, and separately to limit who can invite users to the organization. In Zulip Server 6.1 and below, the UI which allows a user to invite ...

Code injection

Zulip is an open-source team collaboration tool with unique topic-based threading. Zulip administrators can configure Zulip to limit who can add users to streams, and separately to limit who can invite users to the organization. In Zulip Server 6.1 and below, the UI which allows a user to invite ...

CVE-2023-32677

CVE-2023-32677 (Zulip) affects Zulip Server 6.1 and earlier, where the UI for inviting a new user could let the inviter configure which streams the new user is invited to, potentially granting invitations to streams the inviter could not add users to. The underlying issue is a mismatch between wh...

CVE-2023-32677

Zulip is an open-source team collaboration tool with unique topic-based threading. Zulip administrators can configure Zulip to limit who can add users to streams, and separately to limit who can invite users to the organization. In Zulip Server 6.1 and below, the UI which allows a user to invite ...

PT-2023-23953 · Unknown · Zulip Server

Name of the Vulnerable Software and Affected Versions: Zulip Server versions 6.1 and below Description: Zulip is an open-source team collaboration tool with unique topic-based threading. Zulip administrators can configure Zulip to limit who can add users to streams, and separately to limit who ca...

CVE-2022-41914 Non-constant-time SCIM token comparison in Zulip Server

Zulip is an open-source team collaboration tool. For organizations with System for Cross-domain Identity ManagementSCIM account management enabled, Zulip Server 5.0 through 5.6 checked the SCIM bearer token using a comparator that did not run in constant time. Therefore, it might theoretically be...

PT-2022-26145 · Unknown · Zulip Server

Name of the Vulnerable Software and Affected Versions: Zulip Server versions 5.0 through 5.6 Description: Zulip is an open-source team collaboration tool. For organizations with System for Cross-domain Identity Management SCIM account management enabled, it might theoretically be possible for an...

CVE-2022-41914

Zulip Server versions 5.0–5.6 are affected by a non-constant-time SCIM bearer token comparison, enabling potential timing attacks to infer the token value and impersonate the SCIM client to read or update user accounts within an organization. Impact is limited to deployments with SCIM account man...