CVE-2021-30477

CVE-2021-30477 affects Zulip Server prior to 3.4. A bug in the handling of replies to messages sent by outgoing webhooks to private streams allowed an outgoing webhook bot to send messages to private streams that a user was not intended to reach. The impact described is the ability to post to res...