Incorrect authorization in Zulip Server - #VU162561
Published: November 9, 2026
Vulnerability details
The vulnerability allows a remote privileged user to obtain private-channel messages and files outside the scope of members' export consent.
The vulnerability exists due to incorrect authorization in the export_partial_message_files function in zerver/lib/export.py when selecting private channels for an organization export with member consent. A remote privileged user can create an export that includes retained inactive subscriptions to obtain messages and files from private channels that consenting users left or were removed from.
For channels with shared history, the export includes messages sent after the consenting user left. For channels with protected history, it includes messages received while the user was subscribed, despite those messages no longer being accessible to that user.