Vulnerabilities

TI-2026-85140 CVE-2026-115474

Missing authorization in Zulip saves draft DMs without access checks

LOW 29

Zulip is an open-source team collaboration tool.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00332 Published 2026-11-04 Fixed in 12.2 CWE-862

TI-2026-85141 CVE-2026-115574

Missing authorization in Zulip exposes custom profile fields to visitors

LOW 31

Zulip is an open-source team collaboration tool.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00705 Published 2026-11-04 Fixed in 12.2 CWE-862

TI-2026-85135 CVE-2026-97701

Zulip render endpoint lacks length limit, enabling denial of service

LOW 29

Zulip is an open-source team collaboration tool.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00433 Published 2026-11-04 Fixed in 12.2 CWE-770

TI-2026-74168 CVE-2026-100404

Zulip guests can read new messages in unsubscribed public channels

LOW 29

Zulip is an open-source team collaboration tool.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00415 Published 2026-10-14 Fixed in 12.2 CWE-862

TI-2026-74170 CVE-2026-102893

Zulip OpenID Connect login ignores unverified email addresses

MEDIUM 47

Zulip is an open-source team collaboration tool.

CVSS 4.0CRITICAL 9.1 Network No auth No interaction EPSS 0.0039 Published 2026-10-14 Fixed in 12.2 CWE-287

TI-2026-29078 CVE-2026-40300

Zulip: Message edit history visible in "moves only" policy through /api/v1/messages/{id}/history

LOW 26

Zulip is an open-source team collaboration tool.

CVSS 4.0MEDIUM 6.0 Network Low privileges No interaction EPSS 0.00247 Published 2026-05-12 Fixed in 12.0 CWE-284

TI-2026-21062 CVE-2026-26058

Zulip: Path Traversal in Import

MEDIUM 60

Zulip is an open-source team collaboration tool.

CVSS 3.1MEDIUM 6.1 Local No auth User interaction EPSS 0.00246 Published 2026-04-03 Fixed in 11.6 CWE-22

TI-2026-20810 CVE-2026-25742

Zulip: Anonymous File Access After Disabling Spectator Access

MEDIUM 63

Zulip is an open-source team collaboration tool.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00324 Published 2026-04-03 Fixed in 11.6 CWE-862

TI-2026-20809 CVE-2026-25741

Zulip Vulnerable to Modification of Payment Method (Stripe Default Card) by Non-Billing Users

LOW 31

Zulip is an open-source team collaboration tool.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.0031 Published 2026-02-26 No fix listed CWE-863

TI-2026-19378 CVE-2026-24050

Zulip affected by Stored XSS in user profile modal

LOW 7

Zulip is an open-source team collaboration tool.

CVSS 4.0LOW 1.1 Network High privileges User interaction EPSS 0.00262 Published 2026-02-06 Fixed in 11.5 CWE-79

TI-2025-32654 CVE-2025-52559

Zulip XSS in digest preview URL

LOW 30

Zulip is an open-source team chat application.

CVSS 3.1MEDIUM 6.8 Network Low privileges User interaction EPSS 0.00289 Published 2025-07-02 Fixed in 10.4 CWE-79

TI-2025-30323 CVE-2025-47930

Zulip Server has access control bypass for restrictions on creation of specific channel types

LOW 24

Zulip is an open-source team chat application.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00354 Published 2025-05-15 Fixed in 10.3 CWE-863

TI-2025-22659 CVE-2025-31478

Zulip Authentication Backend Configuration Bypass

MEDIUM 42

Zulip is an open-source team collaboration tool.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00361 Published 2025-04-16 Fixed in 10.2 CWE-287

TI-2025-21675 CVE-2025-30369

Zulip allows the deletion of Custom profile fields by administrators of a different organization

LOW 13

Zulip is an open-source team collaboration tool.

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.00277 Published 2025-03-31 Fixed in 10.1 CWE-566

TI-2025-21674 CVE-2025-30368

Zulip allows the deletion of organization by administrators of a different organization

LOW 14

Zulip is an open-source team collaboration tool.

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.00349 Published 2025-03-31 Fixed in 10.1 CWE-566

TI-2025-20006 CVE-2025-27149

Zulip exports can leak private data

LOW 21

Zulip server provides an open-source team chat that helps teams stay productive and focused.

CVSS 4.0MEDIUM 4.6 Network High privileges User interaction EPSS 0.00305 Published 2025-03-31 Fixed in 10.0 CWE-497

TI-2025-18864 CVE-2025-25195

Zulip events can leak private channel names

LOW 20

Zulip is an open source team chat application.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00373 Published 2025-02-13 Fixed in 75be449d456d29fef27e9d1828bafa30174284b4 CWE-200

TI-2024-37129 CVE-2024-56136

/api/v1/jwt/fetch_api_key endpoint can leak if an email address has an account in Zulip server

HIGH 70

Zulip server provides an open-source team chat that helps teams stay productive and focused.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00587 Published 2025-01-16 Fixed in 9.4 CWE-200

TI-2024-24357 CVE-2024-36625 · GHSA-xxvh-8h9p-mpwj

Zulip 8.3 is vulnerable to Cross Site Scripting (XSS) via the replace_emoji_with_text function in ui_util.ts.

LOW 27

Zulip 8.3 is vulnerable to Cross Site Scripting (XSS) via the replace_emoji_with_text function in ui_util.ts.

CVSS 3.1MEDIUM 6.1 Network Low privileges User interaction EPSS 0.00412 Published 2024-11-29 No fix listed CWE-79

TI-2024-24356 CVE-2024-36624 · GHSA-49pw-2xfg-hw49

Zulip 8.3 is vulnerable to Cross Site Scripting (XSS) via the construct_copy_div function in copy_and_paste.js.

LOW 27

Zulip 8.3 is vulnerable to Cross Site Scripting (XSS) via the construct_copy_div function in copy_and_paste.js.

CVSS 3.1MEDIUM 6.1 Network Low privileges User interaction EPSS 0.00412 Published 2024-11-29 No fix listed CWE-79

TI-2024-24345 CVE-2024-36612 · GHSA-v456-9683-gpmq

Zulip from 8.0 to 8.3 contains a memory leak vulnerability in the handling of popovers.

MEDIUM 40

Zulip from 8.0 to 8.3 contains a memory leak vulnerability in the handling of popovers.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0059 Published 2024-11-29 No fix listed CWE-125

TI-2024-18125 CVE-2024-27286

Moving single messages from public to private streams leaves them accessible

LOW 29

Zulip is an open-source team collaboration tool.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00523 Published 2024-03-20 Fixed in 8.3 CWE-200

TI-2024-14355 CVE-2024-21630

Zulip non-admins can invite new users to streams they would not otherwise be able to add existing users to

LOW 20

Zulip is an open-source team collaboration tool.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00368 Published 2024-01-25 No fix listed CWE-862

TI-2023-25782 CVE-2023-47642

Stream description leaks to ex-subscribers in Zulip

LOW 21

Zulip is an open-source team collaboration tool.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00478 Published 2023-11-16 Fixed in 7.5 CWE-200

TI-2023-15954 CVE-2023-32678

Improper authorization in zulip

LOW 29

Zulip is an open-source team collaboration tool with topic-based threading that combines email and chat.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0048 Published 2023-08-25 Fixed in 7.3 CWE-285

Vulnerabilities

Filters