CVE-2017-0896

Zulip Server 1.5.1 and earlier are affected by a flaw in the invite_by_admins_only setting. An authenticated user could invite others to join a Zulip organization even when the organization was configured to prevent this. The issue stems from how the setting is implemented in Zulip’s group chat s...

CVE-2017-0896: Improper Authorization

Zulip Server 1.5.1 and below suffer from an error in the implementation of the invitebyadminsonly setting in the Zulip group chat application server that allowed an authenticated user to invite other users to join a Zulip organization even if the organization was configured to prevent this...