Skip to content
OpenAdvisories

Vendor

zulip

42 known vulnerabilities.

Products

zulip 37 Zulip Server 2 zulip/zulip 2 zulip-mobile 1
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 7.1
    CVE-2026-25741

    Zulip Vulnerable to Modification of Payment Method (Stripe Default Card) by Non-Billing Users

    Zulip is an open-source team collaboration tool. Prior to commit bf28c82dc9b1f630fa8e9106358771b20a0040f7, the API endpoint for creating a card update session during an upgrade flow was accessible to users with only organization member privileges. When the as…

    zulip zulip
  • High 8.2
    CVE-2025-31478

    Zulip Authentication Backend Configuration Bypass

    Zulip is an open-source team collaboration tool. Zulip supports a configuration where account creation is limited solely by being able to authenticate with a single-sign on authentication backend, meaning the organization places no restrictions on email addre…

    zulip zulip
  • High 8.2
    CVE-2023-33186

    Cross-site scripting vulnerability in Zulip Server development branch via topic tooltip

    Zulip is an open-source team collaboration tool with unique topic-based threading that combines the best of email and chat to make remote work productive and delightful. The main development branch of Zulip Server from May 2, 2023 and later, including beta ve…

    zulip zulip
  • High 8.0
    CVE-2022-35962

    Crafted link in Zulip message can cause disclosure of credentials

    Zulip is an open source team chat and Zulip Mobile is an app for iOS and Andriod users. In Zulip Mobile through version 27.189, a crafted link in a message sent by an authenticated user could lead to credential disclosure if a user follows the link. A patch w…

    zulip zulip-mobile
  • High 7.2
    CVE-2022-21706

    Multi-use invitations can grant access to other organizations in Zulip

    Zulip is an open-source team collaboration tool with topic-based threading. Zulip Server version 2.0.0 and above are vulnerable to insufficient access control with multi-use invitations. A Zulip Server deployment which hosts multiple organizations is vulnerab…

    zulip zulip
  • High 8.6
    CVE-2021-43799 Public exploit

    RabbitMQ exposes ports with weak default secrets in Zulip Server

    Zulip is an open-source team collaboration tool. Zulip Server installs RabbitMQ for internal message passing. In versions of Zulip Server prior to 4.9, the initial installation (until first reboot, or restart of RabbitMQ) does not successfully limit the defau…

    zulip zulip