CVE-2024-21630: Zulip non-admins can invite new users to streams they would not otherwise be able to add existing users to

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-01-25 · updated 2026-06-17
Weakness: CWE-862

Description

Zulip is an open-source team collaboration tool. A vulnerability in version 8.0 is similar to CVE-2023-32677, but applies to multi-use invitations, not single-use invitation links as in the prior CVE. Specifically, it applies when the installation has configured non-admins to be able to invite users and create multi-use invitations, and has also configured only admins to be able to invite users to streams. As in CVE-2023-32677, this does not let users invite new users to arbitrary streams, only to streams that the inviter can already see. Version 8.1 fixes this issue. As a workaround, administrators can limit sending of invitations down to users who also have the permission to add users to streams.

Affected products

zulip: from 1.9.0 before 6.2; from 8.0 before 8.1 — fixed in 6.2, 8.1

How to fix

Upgrade to a fixed version: zulip 6.2, 8.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-21630 or the next vulnerability affects your stack