Read the docs
TI-2022-13210 Aliases CVE-2022-31168

Zulip Server insufficient authorization for changing bot roles

Priority MEDIUM 40CWE-285Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-285.

Summary

Zulip is an open source team chat tool. Due to an incorrect authorization check in Zulip Server 5.4 and earlier, a member of an organization could craft an API call that grants organization administrator privileges to one of their bots. The vulnerability is fixed in Zulip Server 5.5. Members who don’t own any bots, and lack permission to create them, can’t exploit the vulnerability. As a workaround for the vulnerability, an organization administrator can restrict the `Who can create bots` permission to administrators only, and change the ownership of existing bots.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00823 57th percentileScored 2026-11-07
Fix Fixed zulip (zulip): 5.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
zulipzulipbefore 5.55.5Patch availableCNA
  • zulip Vendorzulip Affected before 5.5 Fixed in 5.5 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:zulip:zulip:*:*:*:*:*:*:*:*before 5.5Vulnerablezulip
  • cpe:2.3:a:zulip:zulip:*:*:*:*:*:*:*:* Versions before 5.5 Vulnerable ·zulip

Remediation

  • Fix · CNA zulip (zulip) Fixed in 5.5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-31168
  2. 2026-10-09 Priority changed: LOW → MEDIUM

References

Patch 1

Advisory 2

  • TI-2026-20810 Zulip: Anonymous File Access After Disabling Spectator Access CVSS 3.1MEDIUM 5.3
  • TI-2026-21062 Zulip: Path Traversal in Import CVSS 3.1MEDIUM 6.1
  • TI-2021-19605 RabbitMQ exposes ports with weak default secrets in Zulip Server CVSS 3.1CRITICAL 9.8
  • TI-2023-15953 Users who can send invitations can erroneously add users to streams during invitation in Zulip CVSS 3.1LOW 3.1
  • TI-2021-02864 Improper Access Control in zulip/zulip CVSS 3.1HIGH 8.8
  • TI-2022-16387 Crafted link in Zulip message can cause disclosure of credentials CVSS 3.1HIGH 8.0
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences