Incorrect authorization in Zulip Server - #VU162563
Published: November 9, 2026
Vulnerability identifier: #VU162563
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to post messages in another user's private channels and disclose their names, descriptions, and subscriber counts.
The vulnerability exists due to improper authorization in Zulip Server's bot ownership management when a bot changes owners without invalidating its existing API key. A remote user can retain the bot's API key and use it after transferring ownership to another user, or after an administrator reactivates a bot belonging to a deactivated owner, to post messages and list private channels using the new owner's channel permissions.
Exploitation does not allow reading messages in those private channels.
Affected software
Zulip Server
Remediation
Install security update from vendor's website.
Zulip Server - addressed in versions 12.4, 13.0 rc2