Read the docs

zulip

Records69All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical5CVSS 9.0–10.0
CVSS high12CVSS 7.0–8.9

Exploited now

zulip records in CISA KEV

No zulip vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Records

69 records

Priority MEDIUM 60

Zulip is an open-source team collaboration tool.

CVSS 3.1MEDIUM 6.1 Local No auth User interaction EPSS 0.00246 Published 2026-04-03 Fixed in 11.6 CWE-22
Priority MEDIUM 45

In Zulip Server versions from 1.7.0 to before 2.0.7, a bug in the new user signup process meant that users who registered their account using social authentication (e.g., GitHub or Google SSO) in an organization that als…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01352 Published 2019-11-21 No fix listed
TI-2021-02864 CVE-2021-3967 · GHSA-2xp9-33rm-wcwv

Improper Access Control in zulip/zulip

Priority MEDIUM 40

Improper Access Control in GitHub repository zulip/zulip prior to 4.10.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00838 Published 2022-02-26 Fixed in 4.10 CWE-284
TI-2017-00857 CVE-2017-0910 · GHSA-6r66-34x7-46rg

Incorrect authorization in Zulip Server

Priority MEDIUM 40

In Zulip Server before 1.7.1, on a server with multiple realms, a vulnerability in the invitation system lets an authorized user of one realm on the server create a user account on any other realm.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.01087 Published 2017-11-27 Fixed in 1.7.1 CWE-863
Priority LOW 35

Zulip Server before 2.1.5 has Incorrect Access Control because 0198_preregistrationuser_invited_as adds the administrator role to invitations.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00891 Published 2020-08-21 No fix listed CWE-269
Priority LOW 34

Zulip is an open source group chat application.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00955 Published 2022-03-16 Fixed in 4.11 CWE-362
TI-2017-00844 CVE-2017-0896 · GHSA-98x3-p3h4-w982

Improper authorization in Zulip Server

Priority LOW 31

Zulip Server 1.5.1 and below suffer from an error in the implementation of the invite_by_admins_only setting in the Zulip group chat application server that allowed an authenticated user to invite other users to join a Z…

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01278 Published 2017-06-02 No fix listed CWE-285
Load more
Open these records in search →