SB2026110921 - Multiple vulnerabilities in Zulip Server

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026110921

SB2026110921 - Multiple vulnerabilities in Zulip Server

Published: November 9, 2026

Security Bulletin ID SB2026110921
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 vulnerabilities.


1) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to obtain private-channel messages and files outside the scope of members' export consent.

The vulnerability exists due to incorrect authorization in the export_partial_message_files function in zerver/lib/export.py when selecting private channels for an organization export with member consent. A remote privileged user can create an export that includes retained inactive subscriptions to obtain messages and files from private channels that consenting users left or were removed from.

For channels with shared history, the export includes messages sent after the consenting user left. For channels with protected history, it includes messages received while the user was subscribed, despite those messages no longer being accessible to that user.


2) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to download files from a channel without being subscribed to it.

The vulnerability exists due to incorrect authorization in validate_attachment_request in zerver/lib/attachments.py when checking guest access to channel attachments. A remote user can request a known file URL using a guest account included, directly or through a user group, in the channel's "Who can subscribe to this channel" or "Who can subscribe anyone to this channel" permission to download the file without being subscribed to the channel.

For channels with protected history, access is limited to files from messages the guest received while subscribed. The vulnerability does not grant access to channel messages or reveal unknown file URLs.


3) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to post messages in another user's private channels and disclose their names, descriptions, and subscriber counts.

The vulnerability exists due to improper authorization in Zulip Server's bot ownership management when a bot changes owners without invalidating its existing API key. A remote user can retain the bot's API key and use it after transferring ownership to another user, or after an administrator reactivates a bot belonging to a deactivated owner, to post messages and list private channels using the new owner's channel permissions.

Exploitation does not allow reading messages in those private channels.


4) Authentication bypass using an alternate path or channel (CVE-ID: N/A)

CWE-ID: CWE-288 - Authentication Bypass Using an Alternate Path or Channel

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass an organization's single sign-on requirement and create and access an account without using its configured external authentication methods.

The vulnerability exists due to an authentication bypass in HomepageForm.clean_email in zerver/forms.py when processing sign-up requests from reusable invitation links in organizations with only external authentication enabled. A remote user can submit a controlled email address permitted by the organization to /join/<key>/ using a valid reusable invitation link, then follow the emailed confirmation link to create an account and log in without completing single sign-on.

The resulting account has the role and channel subscriptions specified by the invitation link.


5) Exposure of Private Information ('Privacy Violation') (CVE-ID: N/A)

CWE-ID: CWE-359 - Exposure of Private Information ('Privacy Violation')

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to obtain private direct messages from conversations involving deleted users, including messages from participants who have not consented to exporting their private data.

The vulnerability exists due to improper export consent checks in the get_consented_user_ids function in zerver/lib/export.py when generating organization exports of public and private data with member consent. Deleted accounts are converted into mirror dummy accounts, which are treated as consenting regardless of their export consent settings. A remote privileged user can generate an organization export to obtain direct message conversations involving those accounts, including messages from other participants who have not consented.


Remediation

Install update from vendor's website.

References