# cve.now: Zulip

The newest entries naming Zulip as an affected vendor (up to 200), of 42 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-115474](https://cve.now/CVE-2026-115474.md): Zulip: Saving a draft DM to a user bypasses can\_access\_all\_users\_group permission (CVSS 6.5)
- [CVE-2026-115574](https://cve.now/CVE-2026-115574.md): Zulip: Custom profile fields can be read by logged-out visitors in organization with web-public channels (CVSS 5.3)
- [CVE-2026-97701](https://cve.now/CVE-2026-97701.md): Zulip: Missing content-length limit on POST /messages/render allows denial-of-service via oversized requests (CVSS 6.5)
- [CVE-2026-100404](https://cve.now/CVE-2026-100404.md): Zulip: Guests can read new messages in non-subscribed public channels (CVSS 6.5)
- [CVE-2026-102893](https://cve.now/CVE-2026-102893.md): Zulip: OpenID Connect authentication ignores the email\_verified claim (CVSS 9.1)
- [CVE-2026-40300](https://cve.now/CVE-2026-40300.md): Zulip: Message edit history visible in "moves only" policy through /api/v1/messages/{id}/history (CVSS 6.0)
- [CVE-2026-26058](https://cve.now/CVE-2026-26058.md): Zulip: Path Traversal in Import (CVSS 6.1)
- [CVE-2026-25742](https://cve.now/CVE-2026-25742.md): Zulip: Anonymous File Access After Disabling Spectator Access (CVSS 5.3)
- [CVE-2026-25741](https://cve.now/CVE-2026-25741.md): Zulip Vulnerable to Modification of Payment Method (Stripe Default Card) by Non-Billing Users (CVSS 7.1)
- [CVE-2026-24050](https://cve.now/CVE-2026-24050.md): Zulip affected by Stored XSS in user profile modal (CVSS 1.1)
- [CVE-2025-52559](https://cve.now/CVE-2025-52559.md): Zulip XSS in digest preview URL (CVSS 6.8)
- [CVE-2025-47930](https://cve.now/CVE-2025-47930.md): Zulip Server has access control bypass for restrictions on creation of specific channel types (CVSS 5.3)
- [CVE-2025-31478](https://cve.now/CVE-2025-31478.md): Zulip Authentication Backend Configuration Bypass (CVSS 8.2)
- [CVE-2025-30369](https://cve.now/CVE-2025-30369.md): Zulip allows the deletion of Custom profile fields by administrators of a different organization (CVSS 2.7)
- [CVE-2025-30368](https://cve.now/CVE-2025-30368.md): Zulip allows the deletion of organization by administrators of a different organization (CVSS 2.7)
- [CVE-2025-27149](https://cve.now/CVE-2025-27149.md): Zulip exports can leak private data (CVSS 4.6)
- [CVE-2025-25195](https://cve.now/CVE-2025-25195.md): Zulip events can leak private channel names (CVSS 4.3)
- [CVE-2024-56136](https://cve.now/CVE-2024-56136.md): /api/v1/jwt/fetch\_api\_key endpoint can leak if an email address has an account in Zulip server (CVSS 6.9)
- [CVE-2024-27286](https://cve.now/CVE-2024-27286.md): Moving single messages from public to private streams leaves them accessible (CVSS 6.5)
- [CVE-2024-21630](https://cve.now/CVE-2024-21630.md): Zulip non-admins can invite new users to streams they would not otherwise be able to add existing users to (CVSS 4.3)
- [CVE-2023-47642](https://cve.now/CVE-2023-47642.md): Stream description leaks to ex-subscribers in Zulip (CVSS 4.3)
- [CVE-2023-32678](https://cve.now/CVE-2023-32678.md): Zulip vulnerable to insufficient authorization check for edition/deletion of messages and topics in private streams by former subscribers (CVSS 6.5)
- [CVE-2023-33186](https://cve.now/CVE-2023-33186.md): Cross-site scripting vulnerability in Zulip Server development branch via topic tooltip (CVSS 8.2)
- [CVE-2023-28623](https://cve.now/CVE-2023-28623.md): Unauthorized user can register an account in specific configurations in Zulip (CVSS 6.5)
- [CVE-2023-32677](https://cve.now/CVE-2023-32677.md): Users who can send invitations can erroneously add users to streams during invitation in Zulip (CVSS 3.1)
- [CVE-2023-22735](https://cve.now/CVE-2023-22735.md): User uploads proxied from S3 lack \`Content-Security-Policy\` headers, may be served with \`Content-Disposition: inline\` in zulip (CVSS 4.4)
- [CVE-2022-41914](https://cve.now/CVE-2022-41914.md): Non-constant-time SCIM token comparison in Zulip Server (CVSS 3.7)
- [CVE-2022-36048](https://cve.now/CVE-2022-36048.md): IP address leak via image proxy bypass in Zulip Server (CVSS 4.3)
- [CVE-2022-35962](https://cve.now/CVE-2022-35962.md): Crafted link in Zulip message can cause disclosure of credentials (CVSS 8.0)
- [CVE-2022-31168](https://cve.now/CVE-2022-31168.md): Zulip Server insufficient authorization for changing bot roles (CVSS 5.4)
- [CVE-2022-31134](https://cve.now/CVE-2022-31134.md): Zulip Server public data export contains attachments that are non-public (CVSS 4.9)
- [CVE-2022-31017](https://cve.now/CVE-2022-31017.md): Expression Always True vulnerability in Zulip Server (CVSS 2.0)
- [CVE-2022-24751](https://cve.now/CVE-2022-24751.md): Race condition in Zulip (CVSS 5.4)
- [CVE-2022-23656](https://cve.now/CVE-2022-23656.md): Cross-site scripting vulnerability in Zulip Server (CVSS 4.6)
- [CVE-2021-3967](https://cve.now/CVE-2021-3967.md): Improper Access Control in zulip/zulip (CVSS 4.1)
- [CVE-2022-21706](https://cve.now/CVE-2022-21706.md): Multi-use invitations can grant access to other organizations in Zulip (CVSS 7.2)
- [CVE-2021-43799](https://cve.now/CVE-2021-43799.md): RabbitMQ exposes ports with weak default secrets in Zulip Server (CVSS 8.6)
- [CVE-2021-3866](https://cve.now/CVE-2021-3866.md): Cross-site Scripting (XSS) - Stored in zulip/zulip (CVSS 6.8)
- [CVE-2021-43791](https://cve.now/CVE-2021-43791.md): Ineffective expiration validation for invitation links in Zulip (CVSS 6.5)
- [CVE-2021-41115](https://cve.now/CVE-2021-41115.md): Regular expression denial-of-service in Zulip (CVSS 4.3)
- [CVE-2017-0910](https://cve.now/CVE-2017-0910.md): In Zulip Server before 1.7.1, on a server with multiple realms, a vulnerability in the invitation system lets an authorized user of one real (no CVSS)
- [CVE-2017-0896](https://cve.now/CVE-2017-0896.md): Zulip Server 1.5.1 and below suffer from an error in the implementation of the invite\_by\_admins\_only setting in the Zulip group chat applica (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/zulip
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.