# zulip.

Every CVE that names zulip among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Zulip: Saving a draft DM to a user bypasses can_access_all_users_group permission](https://agentprime.io/advisories/CVE-2026-115474.md)
  `CVE-2026-115474` · CVE record: zulip zulip · CVSS 6.5 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Broken access control
- [Zulip: Custom profile fields can be read by logged-out visitors in organization with web-public channels](https://agentprime.io/advisories/CVE-2026-115574.md)
  `CVE-2026-115574` · CVE record: zulip zulip · CVSS 5.3 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Broken access control
- [Zulip: Missing content-length limit on POST /messages/render allows denial-of-service via oversized requests](https://agentprime.io/advisories/CVE-2026-97701.md)
  `CVE-2026-97701` · CVE record: zulip zulip · CVSS 6.5 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Denial of service
- [Zulip: Guests can read new messages in non-subscribed public channels](https://agentprime.io/advisories/CVE-2026-100404.md)
  `CVE-2026-100404` · CVE record: zulip zulip · CVSS 6.5 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Zulip: OpenID Connect authentication ignores the email_verified claim](https://agentprime.io/advisories/CVE-2026-102893.md)
  `CVE-2026-102893` · CVE record: zulip zulip · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: Authentication bypass
- [Zulip: Message edit history visible in "moves only" policy through /api/v1/messages/{id}/history](https://agentprime.io/advisories/CVE-2026-40300.md)
  `CVE-2026-40300` · CVE record: zulip zulip · CVSS 6.0 Medium · Not analysed yet · Published 12 May 2026 · Tags: Broken access control
- [Zulip: Path Traversal in Import](https://agentprime.io/advisories/CVE-2026-26058.md)
  `CVE-2026-26058` · CVE record: zulip zulip · CVSS 6.1 Medium · Not analysed yet · Published 3 Apr 2026 · Tags: Path traversal
- [Zulip: Anonymous File Access After Disabling Spectator Access](https://agentprime.io/advisories/CVE-2026-25742.md)
  `CVE-2026-25742` · CVE record: zulip zulip · CVSS 5.3 Medium · Not analysed yet · Published 3 Apr 2026 · Tags: Broken access control
- [Zulip Vulnerable to Modification of Payment Method (Stripe Default Card) by Non-Billing Users](https://agentprime.io/advisories/CVE-2026-25741.md)
  `CVE-2026-25741` · CVE record: zulip zulip · CVSS 7.1 High · Not analysed yet · Published 26 Feb 2026 · Tags: Broken access control
- [Zulip affected by Stored XSS in user profile modal](https://agentprime.io/advisories/CVE-2026-24050.md)
  `CVE-2026-24050` · CVE record: zulip zulip · CVSS 1.1 Low · Not analysed yet · Published 6 Feb 2026 · Tags: Cross-site scripting (XSS)
- [Zulip XSS in digest preview URL](https://agentprime.io/advisories/CVE-2025-52559.md)
  `CVE-2025-52559` · CVE record: zulip zulip · CVSS 6.8 Medium · Not analysed yet · Published 2 Jul 2025 · Tags: Cross-site scripting (XSS)
- [Zulip Server has access control bypass for restrictions on creation of specific channel types](https://agentprime.io/advisories/CVE-2025-47930.md)
  `CVE-2025-47930` · CVE record: zulip zulip · CVSS 5.3 Medium · Not analysed yet · Published 15 May 2025 · Tags: Broken access control
- [Zulip Authentication Backend Configuration Bypass](https://agentprime.io/advisories/CVE-2025-31478.md)
  `CVE-2025-31478` · CVE record: zulip zulip · CVSS 8.2 High · Not analysed yet · Published 16 Apr 2025 · Tags: Authentication bypass
- [Zulip allows the deletion of Custom profile fields by administrators of a different organization](https://agentprime.io/advisories/CVE-2025-30369.md)
  `CVE-2025-30369` · CVE record: zulip zulip · CVSS 2.7 Low · Not analysed yet · Published 31 Mar 2025 · Tags: CWE-566
- [Zulip allows the deletion of organization by administrators of a different organization](https://agentprime.io/advisories/CVE-2025-30368.md)
  `CVE-2025-30368` · CVE record: zulip zulip · CVSS 2.7 Low · Not analysed yet · Published 31 Mar 2025 · Tags: CWE-566
- [Zulip exports can leak private data](https://agentprime.io/advisories/CVE-2025-27149.md)
  `CVE-2025-27149` · CVE record: zulip zulip · CVSS 4.6 Medium · Not analysed yet · Published 31 Mar 2025 · Tags: Information disclosure
- [Zulip events can leak private channel names](https://agentprime.io/advisories/CVE-2025-25195.md)
  `CVE-2025-25195` · CVE record: zulip zulip · CVSS 4.3 Medium · Not analysed yet · Published 13 Feb 2025 · Tags: Information disclosure
- [/api/v1/jwt/fetch_api_key endpoint can leak if an email address has an account in Zulip server](https://agentprime.io/advisories/CVE-2024-56136.md)
  `CVE-2024-56136` · CVE record: zulip zulip · CVSS 6.9 Medium · Not analysed yet · Published 16 Jan 2025 · Tags: Information disclosure
- [Moving single messages from public to private streams leaves them accessible](https://agentprime.io/advisories/CVE-2024-27286.md)
  `CVE-2024-27286` · CVE record: zulip zulip · CVSS 6.5 Medium · Not analysed yet · Published 20 Mar 2024 · Tags: Information disclosure
- [Zulip non-admins can invite new users to streams they would not otherwise be able to add existing users to](https://agentprime.io/advisories/CVE-2024-21630.md)
  `CVE-2024-21630` · CVE record: zulip zulip · CVSS 4.3 Medium · Not analysed yet · Published 25 Jan 2024 · Tags: Broken access control
- [Stream description leaks to ex-subscribers in Zulip](https://agentprime.io/advisories/CVE-2023-47642.md)
  `CVE-2023-47642` · CVE record: zulip zulip · CVSS 4.3 Medium · Not analysed yet · Published 16 Nov 2023 · Tags: Information disclosure
- [Zulip vulnerable to insufficient authorization check for edition/deletion of messages and topics in private streams by former subscribers](https://agentprime.io/advisories/CVE-2023-32678.md)
  `CVE-2023-32678` · CVE record: zulip zulip · CVSS 6.5 Medium · Not analysed yet · Published 25 Aug 2023 · Tags: Broken access control
- [Cross-site scripting vulnerability in Zulip Server development branch via topic tooltip](https://agentprime.io/advisories/CVE-2023-33186.md)
  `CVE-2023-33186` · CVE record: zulip zulip · CVSS 8.2 High · Not analysed yet · Published 30 May 2023 · Tags: Cross-site scripting (XSS)
- [Unauthorized user can register an account in specific configurations in Zulip](https://agentprime.io/advisories/CVE-2023-28623.md)
  `CVE-2023-28623` · CVE record: zulip zulip · CVSS 6.5 Medium · Not analysed yet · Published 19 May 2023 · Tags: Broken access control
- [Users who can send invitations can erroneously add users to streams during invitation in Zulip](https://agentprime.io/advisories/CVE-2023-32677.md)
  `CVE-2023-32677` · CVE record: zulip zulip · CVSS 3.1 Low · Not analysed yet · Published 19 May 2023 · Tags: Broken access control
- [User uploads proxied from S3 lack \`Content-Security-Policy\` headers, may be served with \`Content-Disposition: inline\` in zulip](https://agentprime.io/advisories/CVE-2023-22735.md)
  `CVE-2023-22735` · CVE record: zulip zulip · CVSS 4.4 Medium · Not analysed yet · Published 7 Feb 2023 · Tags: CWE-436
- [Non-constant-time SCIM token comparison in Zulip Server](https://agentprime.io/advisories/CVE-2022-41914.md)
  `CVE-2022-41914` · CVE record: zulip zulip · CVSS 3.7 Low · Not analysed yet · Published 16 Nov 2022 · Tags: Information disclosure
- [IP address leak via image proxy bypass in Zulip Server](https://agentprime.io/advisories/CVE-2022-36048.md)
  `CVE-2022-36048` · CVE record: zulip zulip · CVSS 4.3 Medium · Not analysed yet · Published 31 Aug 2022 · Tags: CWE-436
- [Improper access control in zulip](https://agentprime.io/advisories/CVE-2016-4427.md)
  `CVE-2016-4427` · CVE record: zulip · No CVSS score · Not analysed yet · Published 28 Jul 2022 · Tags: Broken access control
- [Improper access control in zulip](https://agentprime.io/advisories/CVE-2016-4426.md)
  `CVE-2016-4426` · CVE record: zulip · No CVSS score · Not analysed yet · Published 28 Jul 2022 · Tags: Broken access control
- [Zulip Server insufficient authorization for changing bot roles](https://agentprime.io/advisories/CVE-2022-31168.md)
  `CVE-2022-31168` · CVE record: zulip zulip · CVSS 5.4 Medium · Not analysed yet · Published 22 Jul 2022 · Tags: Broken access control
- [Zulip Server public data export contains attachments that are non-public](https://agentprime.io/advisories/CVE-2022-31134.md)
  `CVE-2022-31134` · CVE record: zulip zulip · CVSS 4.9 Medium · Not analysed yet · Published 12 Jul 2022 · Tags: Information disclosure
- [Expression Always True vulnerability in Zulip Server](https://agentprime.io/advisories/CVE-2022-31017.md)
  `CVE-2022-31017` · CVE record: zulip zulip · CVSS 2.0 Low · Not analysed yet · Published 25 Jun 2022 · Tags: CWE-571, CWE-670
- [Race condition in Zulip](https://agentprime.io/advisories/CVE-2022-24751.md)
  `CVE-2022-24751` · CVE record: zulip zulip · CVSS 5.4 Medium · Not analysed yet · Published 16 Mar 2022 · Tags: Race condition
- [Cross-site scripting vulnerability in Zulip Server](https://agentprime.io/advisories/CVE-2022-23656.md)
  `CVE-2022-23656` · CVE record: zulip zulip · CVSS 4.6 Medium · Not analysed yet · Published 2 Mar 2022 · Tags: Cross-site scripting (XSS)
- [Multi-use invitations can grant access to other organizations in Zulip](https://agentprime.io/advisories/CVE-2022-21706.md)
  `CVE-2022-21706` · CVE record: zulip zulip · CVSS 7.2 High · Not analysed yet · Published 25 Feb 2022 · Tags: Broken access control
- [RabbitMQ exposes ports with weak default secrets in Zulip Server](https://agentprime.io/advisories/CVE-2021-43799.md)
  `CVE-2021-43799` · CVE record: zulip zulip · CVSS 8.6 High · Not analysed yet · Published 25 Jan 2022 · Tags: Weak cryptography or TLS
- [Ineffective expiration validation for invitation links in Zulip](https://agentprime.io/advisories/CVE-2021-43791.md)
  `CVE-2021-43791` · CVE record: zulip zulip · CVSS 6.5 Medium · Not analysed yet · Published 2 Dec 2021 · Tags: Authentication bypass
- [Regular expression denial-of-service in Zulip](https://agentprime.io/advisories/CVE-2021-41115.md)
  `CVE-2021-41115` · CVE record: zulip zulip · CVSS 4.3 Medium · Not analysed yet · Published 7 Oct 2021 · Tags: Denial of service

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=zulip>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/zulip/>. Everything for agents: <https://agentprime.io/llms.txt>.