CVE-2025-25195

Zulip is an open source team chat application. A weekly cron job added in 50256f48314250978f521ef439cafa704e056539 demotes channels to being "inactive" after they have not received traffic for 180 days. However, upon doing so, an event was sent to all users in the organization, not just users in...

CVE-2025-25195

creationtimestamp| type| source ---|---|--- 2025-02-13 21:53:12+00:00| seen| https://infosec.exchange/users/cve/statuses/113998796668998455 2025-02-13 22:16:13+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3li3pny7kot2p 2025-02-13 23:11:16+00:00|...

CVE-2025-25195

Zulip vulnerability CVE-2025-25195 involves a logic flaw in the weekly cron job that demotes channels to “inactive” after 180 days. When a private channel is demoted, an event revealing the private channel name is accidentally broadcast to all users in the organization, and the system also leaks ...