CVE-2017-0896

Zulip Server 1.5.1 and earlier are affected by a flaw in the invite_by_admins_only setting. An authenticated user could invite others to join a Zulip organization even when the organization was configured to prevent this. The issue stems from how the setting is implemented in Zulip’s group chat s...