TI-2023-25782 Aliases CVE-2023-47642

Stream description leaks to ex-subscribers in Zulip

LOW 21CWE-200Published 2023-11-16 · Updated 2024-08-29

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200.

Summary

Zulip is an open-source team collaboration tool. It was discovered by the Zulip development team that active users who had previously been subscribed to a stream incorrectly continued being able to use the Zulip API to access metadata for that stream. As a result, users who had been removed from a stream, but still had an account in the organization, could still view metadata for that stream (including the stream name, description, settings, and an email address used to send emails into the stream via the incoming email integration). This potentially allowed users to see changes to a stream’s metadata after they had lost access to the stream. This vulnerability has been addressed in version 7.5 and all users are advised to upgrade. There are no known workarounds for this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00478 41st percentileScored 2026-11-07

Fix Fixed zulip (zulip): 7.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
zulip	zulip	1.3.0 to before 7.5	7.5	Patch available	CNA

zulip Vendorzulip Affected 1.3.0 to before 7.5 Fixed in 7.5 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:zulip:zulip_server::::::::	1.3.0 to before 7.5	Vulnerable	zulip

cpe:2.3:a:zulip:zulip_server:*:*:*:*:*:*:*:* Versions 1.3.0 to before 7.5 Vulnerable ·zulip

Remediation

Fix · CNA zulip (zulip) Fixed in 7.5

Timeline

2026-10-02 Threatist record created from CVE-2023-47642

References

Patch 1

https://github.com/zulip/zulip/commit/6336322d2f9bbccaacfc80cba83a3c62eefd5737

Advisory 1

https://github.com/zulip/zulip/security/advisories/GHSA-c9wc-65fh-9x8p

TI-2024-37129 /api/v1/jwt/fetch_api_key endpoint can leak if an email address has an account in Zulip server CVSS 4.0MEDIUM 6.9
TI-2022-06082 Multi-use invitations can grant access to other organizations in Zulip CVSS 3.1CRITICAL 9.8
TI-2019-13649 In Zulip Server versions from 1.7.0 to before 2.0.7, a bug in the new user signup process… CVSS 3.1CRITICAL 9.8
TI-2025-22659 Zulip Authentication Backend Configuration Bypass CVSS 3.1HIGH 8.2
TI-2024-24345 Zulip from 8.0 to 8.3 contains a memory leak vulnerability in the handling of popovers. CVSS 3.1HIGH 7.5
TI-2020-11848 Zulip Server 2.x before 2.1.7 allows eval injection if a privileged attacker were able to… CVSS 3.1HIGH 8.8

See all 39 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences