Skip to content
OpenAdvisories
Unscored CVE-2017-0881 EUVD-2017-1235GHSA-435h-5vch-xh86

An error in the implementation of an autosubscribe feature in the check_stream_exists route of the Zulip group chat application server befo…

Published Mar 28, 2017 · Updated Aug 5, 2024 · Assigned by hackerone

Description

An error in the implementation of an autosubscribe feature in the check_stream_exists route of the Zulip group chat application server before 1.4.3 allowed an authenticated user to subscribe to a private stream that should have required an invitation from an existing member to join. The issue affects all previously released versions of the Zulip server.

Affected products

VendorProductAffectedFixed
— Zulip Server Versions 1.4.2 and below Zulip Server Versions 1.4.2 and below —

References