TI-2017-00857 Aliases CVE-2017-0910 GHSA-6r66-34x7-46rg

Incorrect authorization in Zulip Server

MEDIUM 40CWE-863Published 2017-11-27 · Updated 2024-09-17

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-863.

Summary

In Zulip Server before 1.7.1, on a server with multiple realms, a vulnerability in the invitation system lets an authorized user of one realm on the server create a user account on any other realm.

Why it matters now

EPSS 0.01087 65th percentileScored 2026-11-07

Fix Fixed Zulip Server (Zulip): 1.7.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
zulip	Zulip Server	before 1.7.1	1.7.1	Patch available	CNA

Zulip Server Vendorzulip Affected before 1.7.1 Fixed in 1.7.1 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:zulip:zulip_server::::::::	before 1.7.1	Vulnerable	zulip

cpe:2.3:a:zulip:zulip_server:*:*:*:*:*:*:*:* Versions before 1.7.1 Vulnerable ·zulip

Remediation

Fix · CNA Zulip Server (Zulip) Fixed in 1.7.1

Timeline

2026-10-02 Threatist record created from CVE-2017-0910
2026-10-03 Alias added: GHSA-6r66-34x7-46rg

References

Patch 1

https://github.com/zulip/zulip/commit/960d736e55cbb9386a68e4ee45f80581fd2a4e32

Advisory 1

http://blog.zulip.org/2017/11/23/zulip-1-7-1-released/

TI-2024-37129 /api/v1/jwt/fetch_api_key endpoint can leak if an email address has an account in Zulip server CVSS 4.0MEDIUM 6.9
TI-2022-06082 Multi-use invitations can grant access to other organizations in Zulip CVSS 3.1CRITICAL 9.8
TI-2019-13649 In Zulip Server versions from 1.7.0 to before 2.0.7, a bug in the new user signup process… CVSS 3.1CRITICAL 9.8
TI-2025-22659 Zulip Authentication Backend Configuration Bypass CVSS 3.1HIGH 8.2
TI-2024-24345 Zulip from 8.0 to 8.3 contains a memory leak vulnerability in the handling of popovers. CVSS 3.1HIGH 7.5
TI-2020-11848 Zulip Server 2.x before 2.1.7 allows eval injection if a privileged attacker were able to… CVSS 3.1HIGH 8.8

See all 39 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences