TI-2025-21674 Aliases CVE-2025-30368

Zulip allows the deletion of organization by administrators of a different organization

LOW 14CWE-566Published 2025-03-31 · Updated 2025-03-31

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Zulip is an open-source team collaboration tool. The API for deleting an organization export is supposed to be restricted to organization administrators, but its handler failed to check that the field belongs to the same organization as the user. Therefore, an administrator of any organization was incorrectly allowed to delete an export of a different organization. This is fixed in Zulip Server 10.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00349 28th percentileScored 2026-11-07

Fix Fixed zulip (zulip): 10.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
zulip	zulip	10.0-beta1 to before 10.1	10.1	Patch available	CNA

zulip Vendorzulip Affected 10.0-beta1 to before 10.1 Fixed in 10.1 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:zulip:zulip:10.0:::::::*	10.0	Vulnerable	zulip

cpe:2.3:a:zulip:zulip:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·zulip

Remediation

Fix · CNA zulip (zulip) Fixed in 10.1

Timeline

2026-10-02 Threatist record created from CVE-2025-30368

References

Patch 2

Other 1

https://zulip.readthedocs.io/en/latest/overview/changelog.html#zulip-server-10-1

TI-2026-20810 Zulip: Anonymous File Access After Disabling Spectator Access CVSS 3.1MEDIUM 5.3
TI-2026-21062 Zulip: Path Traversal in Import CVSS 3.1MEDIUM 6.1
TI-2021-19605 RabbitMQ exposes ports with weak default secrets in Zulip Server CVSS 3.1CRITICAL 9.8
TI-2023-15953 Users who can send invitations can erroneously add users to streams during invitation in Zulip CVSS 3.1LOW 3.1
TI-2022-13210 Zulip Server insufficient authorization for changing bot roles CVSS 3.1HIGH 8.8
TI-2021-02864 Improper Access Control in zulip/zulip CVSS 3.1HIGH 8.8

See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences