Zulip vulnerabilities
42 CVEs and advisories name Zulip as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-115474Zulip: Saving a draft DM to a user bypasses can_access_all_users_group permission
- CVE-2026-115574Zulip: Custom profile fields can be read by logged-out visitors in organization with web-public channels
- CVE-2026-97701Zulip: Missing content-length limit on POST /messages/render allows denial-of-service via oversized requests
- CVE-2026-100404Zulip: Guests can read new messages in non-subscribed public channels
- CVE-2026-102893Zulip: OpenID Connect authentication ignores the email_verified claim
- CVE-2026-40300Zulip: Message edit history visible in "moves only" policy through /api/v1/messages/{id}/history
- CVE-2026-26058Zulip: Path Traversal in Import
- CVE-2026-25742Zulip: Anonymous File Access After Disabling Spectator Access
- CVE-2026-25741Zulip Vulnerable to Modification of Payment Method (Stripe Default Card) by Non-Billing Users
- CVE-2026-24050Zulip affected by Stored XSS in user profile modal
- CVE-2025-52559Zulip XSS in digest preview URL
- CVE-2025-47930Zulip Server has access control bypass for restrictions on creation of specific channel types
- CVE-2025-31478Zulip Authentication Backend Configuration Bypass
- CVE-2025-30369Zulip allows the deletion of Custom profile fields by administrators of a different organization
- CVE-2025-30368Zulip allows the deletion of organization by administrators of a different organization
- CVE-2025-27149Zulip exports can leak private data
- CVE-2025-25195Zulip events can leak private channel names
- CVE-2024-56136/api/v1/jwt/fetch_api_key endpoint can leak if an email address has an account in Zulip server
- CVE-2024-27286Moving single messages from public to private streams leaves them accessible
- CVE-2024-21630Zulip non-admins can invite new users to streams they would not otherwise be able to add existing users to
- CVE-2023-47642Stream description leaks to ex-subscribers in Zulip
- CVE-2023-32678Zulip vulnerable to insufficient authorization check for edition/deletion of messages and topics in private streams by former subscribers
- CVE-2023-33186Cross-site scripting vulnerability in Zulip Server development branch via topic tooltip
- CVE-2023-28623Unauthorized user can register an account in specific configurations in Zulip
- CVE-2023-32677Users who can send invitations can erroneously add users to streams during invitation in Zulip
- CVE-2023-22735User uploads proxied from S3 lack `Content-Security-Policy` headers, may be served with `Content-Disposition: inline` in zulip
- CVE-2022-41914Non-constant-time SCIM token comparison in Zulip Server
- CVE-2022-36048IP address leak via image proxy bypass in Zulip Server
- CVE-2022-35962Crafted link in Zulip message can cause disclosure of credentials
- CVE-2022-31168Zulip Server insufficient authorization for changing bot roles