zulip.

Zulip: Saving a draft DM to a user bypasses can_access_all_users_group permission

• zulip
• Broken access control

Zulip: Custom profile fields can be read by logged-out visitors in organization with web-public channels

• zulip
• Broken access control

Zulip: Missing content-length limit on POST /messages/render allows denial-of-service via oversized requests

• zulip
• Denial of service

Zulip: Guests can read new messages in non-subscribed public channels

• zulip
• Broken access control

Zulip: OpenID Connect authentication ignores the email_verified claim

• zulip
• Authentication bypass

Zulip: Message edit history visible in "moves only" policy through /api/v1/messages/{id}/history

• zulip
• Broken access control

Zulip: Path Traversal in Import

• zulip
• Path traversal

Zulip: Anonymous File Access After Disabling Spectator Access

• zulip
• Broken access control

Zulip Vulnerable to Modification of Payment Method (Stripe Default Card) by Non-Billing Users

• zulip
• Broken access control

Zulip affected by Stored XSS in user profile modal

• zulip
• Cross-site scripting (XSS)

Zulip XSS in digest preview URL

• zulip
• Cross-site scripting (XSS)

Zulip Server has access control bypass for restrictions on creation of specific channel types

• zulip
• Broken access control

Zulip Authentication Backend Configuration Bypass

• zulip
• Authentication bypass

Zulip allows the deletion of Custom profile fields by administrators of a different organization

• zulip
• CWE-566

Zulip allows the deletion of organization by administrators of a different organization

• zulip
• CWE-566

Zulip exports can leak private data

• zulip
• Information disclosure

Zulip events can leak private channel names

• zulip
• Information disclosure

/api/v1/jwt/fetch_api_key endpoint can leak if an email address has an account in Zulip server

• zulip
• Information disclosure

Moving single messages from public to private streams leaves them accessible

• zulip
• Information disclosure

Zulip non-admins can invite new users to streams they would not otherwise be able to add existing users to

• zulip
• Broken access control

Stream description leaks to ex-subscribers in Zulip

• zulip
• Information disclosure

Zulip vulnerable to insufficient authorization check for edition/deletion of messages and topics in private streams by former subscribers

• zulip
• Broken access control

Cross-site scripting vulnerability in Zulip Server development branch via topic tooltip

• zulip
• Cross-site scripting (XSS)

Unauthorized user can register an account in specific configurations in Zulip

• zulip
• Broken access control

Users who can send invitations can erroneously add users to streams during invitation in Zulip

• zulip
• Broken access control

User uploads proxied from S3 lack `Content-Security-Policy` headers, may be served with `Content-Disposition: inline` in zulip

• zulip
• CWE-436

Non-constant-time SCIM token comparison in Zulip Server

• zulip
• Information disclosure

IP address leak via image proxy bypass in Zulip Server

• zulip
• CWE-436

Improper access control in zulip

• zulip
• Broken access control

Improper access control in zulip

• zulip
• Broken access control

Zulip Server insufficient authorization for changing bot roles

• zulip
• Broken access control

Zulip Server public data export contains attachments that are non-public

• zulip
• Information disclosure

Expression Always True vulnerability in Zulip Server

• zulip
• CWE-571
• CWE-670

Race condition in Zulip

• zulip
• Race condition

Cross-site scripting vulnerability in Zulip Server

• zulip
• Cross-site scripting (XSS)

Multi-use invitations can grant access to other organizations in Zulip

• zulip
• Broken access control

RabbitMQ exposes ports with weak default secrets in Zulip Server

• zulip
• Weak cryptography or TLS

Ineffective expiration validation for invitation links in Zulip

• zulip
• Authentication bypass

Regular expression denial-of-service in Zulip

• zulip
• Denial of service