Zulip events can leak private channel names
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200.
Summary
Zulip is an open source team chat application. A weekly cron job (added in 50256f48314250978f521ef439cafa704e056539) demotes channels to being "inactive" after they have not received traffic for 180 days. However, upon doing so, an event was sent to all users in the organization, not just users in the channel. This event contained the name of the private channel. Similarly, the same commit (50256f48314250978f521ef439cafa704e056539) added functionality to notify clients when channels stopped being "inactive." The first message sent to a private channel which had not previously had any messages for over 180 days (and were thus already marked "inactive") would leak an event to all users in the organization; this event also contained the name of the private channel. Commits 75be449d456d29fef27e9d1828bafa30174284b4 and a2a1a7f8d152296c8966f1380872c0ac69e5c87e fixed the issue. This vulnerability only existed in `main`, and was not part of any published versions.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| zulip | zulip | 50256f48314250978f521ef439cafa704e056539 to before 75be449d456d29fef27e9d1828bafa30174284b4 | 75be449d456d29fef27e9d1828bafa30174284b4 | Patch available | CNA |
- zulip Vendorzulip Affected 50256f48314250978f521ef439cafa704e056539 to before 75be449d456d29fef27e9d1828bafa30174284b4 Fixed in 75be449d456d29fef27e9d1828bafa30174284b4 Patch available CNA
Remediation
- Fix · CNA zulip (zulip) Fixed in 75be449d456d29fef27e9d1828bafa30174284b4
Timeline
- 2026-10-02 Threatist record created from CVE-2025-25195
References
Other 4
- https://github.com/zulip/zulip/security/advisories/GHSA-x8cx-3hq5-4wj9
- https://github.com/zulip/zulip/commit/50256f48314250978f521ef439cafa704e056539
- https://github.com/zulip/zulip/commit/75be449d456d29fef27e9d1828bafa30174284b4
- https://github.com/zulip/zulip/commit/a2a1a7f8d152296c8966f1380872c0ac69e5c87e
More zulip vulnerabilities
- TI-2024-37129 /api/v1/jwt/fetch_api_key endpoint can leak if an email address has an account in Zulip server CVSS 4.0MEDIUM 6.9
- TI-2026-20810 Zulip: Anonymous File Access After Disabling Spectator Access CVSS 3.1MEDIUM 5.3
- TI-2026-21062 Zulip: Path Traversal in Import CVSS 3.1MEDIUM 6.1
- TI-2021-19605 RabbitMQ exposes ports with weak default secrets in Zulip Server CVSS 3.1CRITICAL 9.8
- TI-2022-06082 Multi-use invitations can grant access to other organizations in Zulip CVSS 3.1CRITICAL 9.8
- TI-2023-15953 Users who can send invitations can erroneously add users to streams during invitation in Zulip CVSS 3.1LOW 3.1
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences