What’s Vulnerable › Products
zulip vulnerabilities
44 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 11 published in the last 12 months.
Check whether your zulip version is affected
Latest zulip vulnerabilities
- CVE-2026-102893 — Zulip: OpenID Connect authentication ignores the email_verified claim (CVSS 9.1)
- CVE-2026-40300 — Zulip: Message edit history visible in "moves only" policy through /api/v1/messages/{id}/history (CVSS 6.5)
- CVE-2026-25741 — Zulip Vulnerable to Modification of Payment Method (Stripe Default Card) by Non-Billing Users (CVSS 7.1)
- CVE-2026-24050 — Zulip affected by Stored XSS in user profile modal (CVSS 5.4)
- CVE-2025-52559 — Zulip XSS in digest preview URL (CVSS 5.4)
- CVE-2025-31478 — Zulip Authentication Backend Configuration Bypass (CVSS 8.2)
- CVE-2025-30369 — Zulip allows the deletion of Custom profile fields by administrators of a different organization (CVSS 2.7)
- CVE-2025-27149 — Zulip exports can leak private data (CVSS 2.7)
- CVE-2025-25195 — Zulip events can leak private channel names (CVSS 4.3)
- CVE-2024-56136 — /api/v1/jwt/fetch_api_key endpoint can leak if an email address has an account in Zulip server (CVSS 5.3)
- CVE-2024-36612 — (CVSS 7.5)
- CVE-2024-27286 — Moving single messages from public to private streams leaves them accessible (CVSS 6.5)
- CVE-2024-21630 — Zulip non-admins can invite new users to streams they would not otherwise be able to add existing users to (CVSS 4.3)
- CVE-2023-47642 — Stream description leaks to ex-subscribers in Zulip (CVSS 4.3)
- CVE-2023-32678 — Zulip vulnerable to insufficient authorization check for edition/deletion of messages and topics in private streams by former subscribers (CVSS 6.5)
- CVE-2023-33186 — Cross-site scripting vulnerability in Zulip Server development branch via topic tooltip (CVSS 6.1)
- CVE-2023-22735 — User uploads proxied from S3 lack `Content-Security-Policy` headers, may be served with `Content-Disposition: inline` in zulip (CVSS 4.6)
- CVE-2022-41914 — Non-constant-time SCIM token comparison in Zulip Server (CVSS 3.7)
- CVE-2022-31134 — Zulip Server public data export contains attachments that are non-public (CVSS 4.9)
- CVE-2022-23656 — Cross-site scripting vulnerability in Zulip Server (CVSS 5.4)
- CVE-2022-21706 — Multi-use invitations can grant access to other organizations in Zulip (CVSS 9.8)
- CVE-2021-30487 — (CVSS 2.7)
- CVE-2021-30479 — (CVSS 5.3)
- CVE-2021-30478 — (CVSS 4.3)
- CVE-2021-30477 — (CVSS 4.3)