Vulnerabilities in Zulip
42 resultsCVE-2023-28623MEDIUMUnauthorized user can register an account in specific configurations in ZulipEPSS 0.5%CVE-2024-27286MEDIUMMoving single messages from public to private streams leaves them accessibleEPSS 0.5%CVE-2023-22735MEDIUMUser uploads proxied from S3 lack `Content-Security-Policy` headers, may be served with `Content-Disposition: inline` in zulipEPSS 0.5%CVE-2023-32678MEDIUMZulip vulnerable to insufficient authorization check for edition/deletion of messages and topics in private streams by former subscribersEPSS 0.5%CVE-2023-47642MEDIUMStream description leaks to ex-subscribers in ZulipEPSS 0.5%CVE-2026-97701MEDIUMZulip: Missing content-length limit on POST /messages/render allows denial-of-service via oversized requestsEPSS 0.4%CVE-2026-100404MEDIUMZulip: Guests can read new messages in non-subscribed public channelsEPSS 0.4%CVE-2026-102893CRITICALZulip: OpenID Connect authentication ignores the email_verified claimEPSS 0.4%CVE-2025-25195MEDIUMZulip events can leak private channel namesEPSS 0.4%CVE-2024-21630MEDIUMZulip non-admins can invite new users to streams they would not otherwise be able to add existing users toEPSS 0.4%CVE-2025-31478HIGHZulip Authentication Backend Configuration BypassEPSS 0.4%CVE-2025-47930MEDIUMZulip Server has access control bypass for restrictions on creation of specific channel typesEPSS 0.4%CVE-2025-30368LOWZulip allows the deletion of organization by administrators of a different organizationEPSS 0.3%CVE-2026-115474MEDIUMZulip: Saving a draft DM to a user bypasses can_access_all_users_group permissionEPSS 0.3%CVE-2026-25742MEDIUMZulip: Anonymous File Access After Disabling Spectator AccessEPSS 0.3%CVE-2026-25741HIGHZulip Vulnerable to Modification of Payment Method (Stripe Default Card) by Non-Billing UsersEPSS 0.3%CVE-2025-27149MEDIUMZulip exports can leak private dataEPSS 0.3%CVE-2025-52559MEDIUMZulip XSS in digest preview URLEPSS 0.3%CVE-2025-30369LOWZulip allows the deletion of Custom profile fields by administrators of a different organizationEPSS 0.3%CVE-2026-24050LOWZulip affected by Stored XSS in user profile modalEPSS 0.3%