Vulnerabilities

TI-2026-29078 CVE-2026-40300

Zulip: Message edit history visible in "moves only" policy through /api/v1/messages/{id}/history

LOW 26

Zulip is an open-source team collaboration tool.

CVSS 4.0MEDIUM 6.0 Network Low privileges No interaction EPSS 0.00247 Published 2026-05-12 Fixed in 12.0 CWE-284

TI-2026-19378 CVE-2026-24050

Zulip affected by Stored XSS in user profile modal

LOW 7

Zulip is an open-source team collaboration tool.

CVSS 4.0LOW 1.1 Network High privileges User interaction EPSS 0.00262 Published 2026-02-06 Fixed in 11.5 CWE-79

TI-2025-32654 CVE-2025-52559

Zulip XSS in digest preview URL

LOW 30

Zulip is an open-source team chat application.

CVSS 3.1MEDIUM 6.8 Network Low privileges User interaction EPSS 0.00289 Published 2025-07-02 Fixed in 10.4 CWE-79

TI-2025-22659 CVE-2025-31478

Zulip Authentication Backend Configuration Bypass

MEDIUM 42

Zulip is an open-source team collaboration tool.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00361 Published 2025-04-16 Fixed in 10.2 CWE-287

TI-2025-21675 CVE-2025-30369

Zulip allows the deletion of Custom profile fields by administrators of a different organization

LOW 13

Zulip is an open-source team collaboration tool.

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.00277 Published 2025-03-31 Fixed in 10.1 CWE-566

TI-2025-20006 CVE-2025-27149

Zulip exports can leak private data

LOW 21

Zulip server provides an open-source team chat that helps teams stay productive and focused.

CVSS 4.0MEDIUM 4.6 Network High privileges User interaction EPSS 0.00305 Published 2025-03-31 Fixed in 10.0 CWE-497

TI-2024-37129 CVE-2024-56136

/api/v1/jwt/fetch_api_key endpoint can leak if an email address has an account in Zulip server

HIGH 70

Zulip server provides an open-source team chat that helps teams stay productive and focused.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00587 Published 2025-01-16 Fixed in 9.4 CWE-200

TI-2024-24345 CVE-2024-36612 · GHSA-v456-9683-gpmq

Zulip from 8.0 to 8.3 contains a memory leak vulnerability in the handling of popovers.

MEDIUM 40

Zulip from 8.0 to 8.3 contains a memory leak vulnerability in the handling of popovers.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0059 Published 2024-11-29 No fix listed CWE-125

TI-2024-18125 CVE-2024-27286

Moving single messages from public to private streams leaves them accessible

LOW 29

Zulip is an open-source team collaboration tool.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00523 Published 2024-03-20 Fixed in 8.3 CWE-200

TI-2024-14355 CVE-2024-21630

Zulip non-admins can invite new users to streams they would not otherwise be able to add existing users to

LOW 20

Zulip is an open-source team collaboration tool.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00368 Published 2024-01-25 No fix listed CWE-862

TI-2023-25782 CVE-2023-47642

Stream description leaks to ex-subscribers in Zulip

LOW 21

Zulip is an open-source team collaboration tool.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00478 Published 2023-11-16 Fixed in 7.5 CWE-200

TI-2023-15954 CVE-2023-32678

Improper authorization in zulip

LOW 29

Zulip is an open-source team collaboration tool with topic-based threading that combines email and chat.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0048 Published 2023-08-25 Fixed in 7.3 CWE-285

TI-2023-16363 CVE-2023-33186

Cross-site scripting vulnerability in Zulip Server development branch via topic tooltip

LOW 37

Zulip is an open-source team collaboration tool with unique topic-based threading that combines the best of email and chat to make remote work productive and delightful.

CVSS 3.1HIGH 8.2 Network Low privileges User interaction EPSS 0.00617 Published 2023-05-30 Fixed in 7.0-beta3 CWE-79

TI-2023-08909 CVE-2023-22735

User uploads proxied from S3 lack `Content-Security-Policy` headers, may be served with…

LOW 22

Zulip is an open-source team collaboration tool.

CVSS 3.1MEDIUM 4.6 Network Low privileges User interaction EPSS 0.00515 Published 2023-02-07 Fixed in 2f6c5a8 CWE-436

TI-2022-20255 CVE-2022-41914

Non-constant-time SCIM token comparison in Zulip Server

LOW 18

Zulip is an open-source team collaboration tool.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00575 Published 2022-11-16 Fixed in 5.7 CWE-200

TI-2022-13178 CVE-2022-31134

Zulip Server public data export contains attachments that are non-public

LOW 24

Zulip is an open-source team collaboration tool.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00919 Published 2022-07-12 Fixed in 5.4 CWE-200

TI-2022-07708 CVE-2022-23656

Cross-site scripting vulnerability in Zulip Server

LOW 25

Zulip is an open source team chat app.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00584 Published 2022-03-02 Fixed in 2022-03-01 CWE-79

TI-2022-06082 CVE-2022-21706

Multi-use invitations can grant access to other organizations in Zulip

MEDIUM 50

Zulip is an open-source team collaboration tool with topic-based threading.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01206 Published 2022-02-25 Fixed in 4.10 CWE-284

TI-2021-10881 CVE-2021-30479 · GHSA-r3hv-m3j5-mrfp

An issue was discovered in Zulip Server before 3.4.

LOW 26

An issue was discovered in Zulip Server before 3.4.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00862 Published 2021-04-14 No fix listed CWE-269

TI-2021-10880 CVE-2021-30478 · GHSA-7f6g-27rf-r8f2

An issue was discovered in Zulip Server before 3.4.

LOW 21

An issue was discovered in Zulip Server before 3.4.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00575 Published 2021-04-14 No fix listed CWE-269

TI-2021-10879 CVE-2021-30477 · GHSA-45v2-23j7-x684

An issue was discovered in Zulip Server before 3.4.

LOW 21

An issue was discovered in Zulip Server before 3.4.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00656 Published 2021-04-14 No fix listed

TI-2021-10888 CVE-2021-30487 · GHSA-2c8p-8v35-g4g6

In the topic moving API in Zulip Server 3.x before 3.4, organization administrators were…

LOW 15

In the topic moving API in Zulip Server 3.x before 3.4, organization administrators were able to move messages to streams in other organizations hosted by the same Zulip installation.

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.00651 Published 2021-04-14 No fix listed

TI-2020-10144 CVE-2020-12759 · GHSA-pcfx-cw33-q34q

Zulip Server before 2.1.5 allows reflected XSS via the Dropbox webhook.

LOW 28

Zulip Server before 2.1.5 allows reflected XSS via the Dropbox webhook.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00671 Published 2020-08-21 No fix listed CWE-79

TI-2020-11117 CVE-2020-14194 · GHSA-r3h7-q69r-j2c6

Zulip Server before 2.1.5 allows reverse tabnapping via a topic header link.

LOW 26

Zulip Server before 2.1.5 allows reverse tabnapping via a topic header link.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00685 Published 2020-08-21 No fix listed CWE-269

TI-2020-11135 CVE-2020-14215 · GHSA-cwgg-2v4v-j88m

Zulip Server before 2.1.5 has Incorrect Access Control because…

LOW 35

Zulip Server before 2.1.5 has Incorrect Access Control because 0198_preregistrationuser_invited_as adds the administrator role to invitations.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00891 Published 2020-08-21 No fix listed CWE-269

Vulnerabilities

Filters