CVE-2026-40300 | Medium | 6.5 | 2026-05-12 | Zulip is an open-source team collaboration tool. Prior to 12.0, With message_edit_history_visibility_policy set to "moves", /api/v1/messages/{id}/history still… |
CVE-2026-26058 | Medium | 6.1 | 2026-04-03 | Zulip is an open-source team collaboration tool. From version 1.4.0 to before version 11.6, ./manage.py import reads arbitrary files from the server filesystem… |
CVE-2026-25742 | Medium | 5.3 | 2026-04-03 | Zulip is an open-source team collaboration tool. Prior to version 11.6, Zulip is an open-source team collaboration tool. From version 1.4.0 to before version 1… |
CVE-2026-25741 | High | 7.1 | 2026-02-26 | Zulip is an open-source team collaboration tool. Prior to commit bf28c82dc9b1f630fa8e9106358771b20a0040f7, the API endpoint for creating a card update session… |
CVE-2026-24050 | Medium | 5.4 | 2026-02-06 | Zulip is an open-source team collaboration tool. From 5.0 to before 11.5, some administrative actions on the user profile were susceptible to stored XSS in gro… |
CVE-2025-52559 | Medium | 6.8 | 2025-07-02 | Zulip is an open-source team chat application. From versions 2.0.0-rc1 to before 10.4 in Zulip Server, the /digest/ URL of a server shows a preview of what the… |
CVE-2025-47930 | Medium | 5.3 | 2025-05-16 | Zulip is an open-source team chat application. Starting in version 10.0 and prior to version 10.3, the "Who can create public channels" access control mechanis… |
CVE-2025-31478 | High | 8.2 | 2025-04-16 | Zulip is an open-source team collaboration tool. Zulip supports a configuration where account creation is limited solely by being able to authenticate with a s… |
CVE-2025-30369 | Low | 2.7 | 2025-03-31 | Zulip is an open-source team collaboration tool. The API for deleting an organization custom profile field is supposed to be restricted to organization adminis… |
CVE-2025-30368 | Low | 2.7 | 2025-03-31 | Zulip is an open-source team collaboration tool. The API for deleting an organization export is supposed to be restricted to organization administrators, but i… |
CVE-2025-27149 | Low | 2.7 | 2025-03-31 | Zulip server provides an open-source team chat that helps teams stay productive and focused. Prior to 10.0, the data export to organization administrators feat… |
CVE-2025-25195 | Medium | 4.3 | 2025-02-13 | Zulip is an open source team chat application. A weekly cron job (added in 50256f48314250978f521ef439cafa704e056539) demotes channels to being "inactive" after… |
CVE-2024-56136 | Medium | 5.3 | 2025-01-16 | Zulip server provides an open-source team chat that helps teams stay productive and focused. Zulip Server 7.0 and above are vulnerable to an information disclo… |
CVE-2024-36612 | High | 7.5 | 2024-11-29 | Zulip from 8.0 to 8.3 contains a memory leak vulnerability in the handling of popovers. |
CVE-2024-36624 | Medium | 5.4 | 2024-11-29 | Zulip 8.3 is vulnerable to Cross Site Scripting (XSS) via the construct_copy_div function in copy_and_paste.js. |
CVE-2024-36625 | Medium | 5.4 | 2024-11-29 | Zulip 8.3 is vulnerable to Cross Site Scripting (XSS) via the replace_emoji_with_text function in ui_util.ts. |
CVE-2024-27286 | Medium | 6.5 | 2024-03-20 | Zulip is an open-source team collaboration tool. When a user moves a Zulip message, they have the option to move all messages in the topic, move only subsequen… |
CVE-2024-21630 | Medium | 4.3 | 2024-01-25 | Zulip is an open-source team collaboration tool. A vulnerability in version 8.0 is similar to CVE-2023-32677, but applies to multi-use invitations, not single-… |
CVE-2023-47642 | Medium | 4.3 | 2023-11-16 | Zulip is an open-source team collaboration tool. It was discovered by the Zulip development team that active users who had previously been subscribed to a stre… |
CVE-2023-32678 | Medium | 6.5 | 2023-08-25 | Zulip is an open-source team collaboration tool with topic-based threading that combines email and chat. Users who used to be subscribed to a private stream an… |
CVE-2023-33186 | High | 8.2 | 2023-05-30 | Zulip is an open-source team collaboration tool with unique topic-based threading that combines the best of email and chat to make remote work productive and d… |
CVE-2023-28623 | Medium | 6.5 | 2023-05-19 | Zulip is an open-source team collaboration tool with unique topic-based threading. In the event that 1: `ZulipLDAPAuthBackend` and an external authentication b… |
CVE-2023-32677 | Low | 3.1 | 2023-05-19 | Zulip is an open-source team collaboration tool with unique topic-based threading. Zulip administrators can configure Zulip to limit who can add users to strea… |
CVE-2023-22735 | Medium | 4.4 | 2023-02-07 | Zulip is an open-source team collaboration tool. In versions of zulip prior to commit `2f6c5a8` but after commit `04cf68b` users could upload files with arbitr… |
CVE-2022-41914 | Low | 3.7 | 2022-11-16 | Zulip is an open-source team collaboration tool. For organizations with System for Cross-domain Identity Management(SCIM) account management enabled, Zulip Ser… |
CVE-2022-36048 | Medium | 4.3 | 2022-08-31 | Zulip is an open-source team collaboration tool with topic-based threading that combines email and chat. When displaying messages with embedded remote images… |
CVE-2022-35962 | High | 8.0 | 2022-08-29 | Zulip is an open source team chat and Zulip Mobile is an app for iOS and Andriod users. In Zulip Mobile through version 27.189, a crafted link in a message sen… |
CVE-2016-4427 | High | 7.5 | 2022-07-28 | In zulip before 1.3.12, deactivated users could access messages if SSO was enabled. |
CVE-2016-4426 | Medium | 4.3 | 2022-07-28 | In zulip before 1.3.12, bot API keys were accessible to other users in the same realm. |
CVE-2022-31168 | Medium | 5.4 | 2022-07-22 | Zulip is an open source team chat tool. Due to an incorrect authorization check in Zulip Server 5.4 and earlier, a member of an organization could craft an API… |
CVE-2022-31134 | Medium | 4.9 | 2022-07-12 | Zulip is an open-source team collaboration tool. Zulip Server versions 2.1.0 above have a user interface tool, accessible only to server owners and server admi… |
CVE-2022-31017 | Low | 2.0 | 2022-06-25 | Zulip is an open-source team collaboration tool. Versions 2.1.0 through and including 5.2 are vulnerable to a logic error. A stream configured as private with… |
CVE-2022-24751 | Medium | 5.4 | 2022-03-16 | Zulip is an open source group chat application. Starting with version 4.0 and prior to version 4.11, Zulip is vulnerable to a race condition during account dea… |
CVE-2022-23656 | Medium | 4.6 | 2022-03-02 | Zulip is an open source team chat app. The `main` development branch of Zulip Server from June 2021 and later is vulnerable to a cross-site scripting vulnerabi… |
CVE-2021-3967 | High | 8.8 | 2022-02-26 | Improper Access Control in GitHub repository zulip/zulip prior to 4.10. |
CVE-2022-21706 | High | 7.2 | 2022-02-26 | Zulip is an open-source team collaboration tool with topic-based threading. Zulip Server version 2.0.0 and above are vulnerable to insufficient access control… |
CVE-2021-43799 | High | 8.6 | 2022-01-25 | Zulip is an open-source team collaboration tool. Zulip Server installs RabbitMQ for internal message passing. In versions of Zulip Server prior to 4.9, the ini… |
CVE-2021-3866 | Medium | 5.4 | 2022-01-20 | Cross-site Scripting (XSS) - Stored in GitHub repository zulip/zulip more than and including 44f935695d452cc3fb16845a0c6af710438b153d and prior to 3eb2791c3e96… |
CVE-2021-43791 | Medium | 6.5 | 2021-12-02 | Zulip is an open source group chat application that combines real-time chat with threaded conversations. In affected versions expiration dates on the confirmat… |
CVE-2021-41115 | Medium | 4.3 | 2021-10-07 | Zulip is an open source team chat server. In affected versions Zulip allows organization administrators on a server to configure "linkifiers" that automaticall… |
CVE-2021-30487 | Low | 2.7 | 2021-04-15 | In the topic moving API in Zulip Server 3.x before 3.4, organization administrators were able to move messages to streams in other organizations hosted by the… |
CVE-2021-30479 | Medium | 5.3 | 2021-04-15 | An issue was discovered in Zulip Server before 3.4. A bug in the implementation of the all_public_streams API feature resulted in guest users being able to rec… |
CVE-2021-30478 | Medium | 4.3 | 2021-04-15 | An issue was discovered in Zulip Server before 3.4. A bug in the implementation of the can_forge_sender permission (previously is_api_super_user) resulted in u… |
CVE-2021-30477 | Medium | 4.3 | 2021-04-15 | An issue was discovered in Zulip Server before 3.4. A bug in the implementation of replies to messages sent by outgoing webhooks to private streams meant that… |
CVE-2020-10858 | Medium | 5.3 | 2021-02-05 | Zulip Desktop before 5.0.0 allows attackers to perform recording via the webcam and microphone due to a missing permission request handler. |
CVE-2020-10857 | Critical | 9.8 | 2021-02-05 | Zulip Desktop before 5.0.0 improperly uses shell.openExternal and shell.openItem with untrusted content, leading to remote code execution. |
CVE-2020-15070 | High | 8.8 | 2020-08-21 | Zulip Server 2.x before 2.1.7 allows eval injection if a privileged attacker were able to write directly to the postgres database, and chose to write a crafted… |
CVE-2020-14215 | High | 7.5 | 2020-08-21 | Zulip Server before 2.1.5 has Incorrect Access Control because 0198_preregistrationuser_invited_as adds the administrator role to invitations. |
CVE-2020-14194 | Medium | 5.4 | 2020-08-21 | Zulip Server before 2.1.5 allows reverse tabnapping via a topic header link. |
CVE-2020-12759 | Medium | 6.1 | 2020-08-21 | Zulip Server before 2.1.5 allows reflected XSS via the Dropbox webhook. |
CVE-2020-9445 | Medium | 6.1 | 2020-04-20 | Zulip Server before 2.1.3 allows XSS via the modal_link feature in the Markdown functionality. |
CVE-2020-9444 | Medium | 6.1 | 2020-04-20 | Zulip Server before 2.1.3 allows reverse tabnabbing via the Markdown functionality. |
CVE-2020-10935 | Medium | 5.4 | 2020-04-20 | Zulip Server before 2.1.3 allows XSS via a Markdown link, with resultant account takeover. |
CVE-2019-19775 | Medium | 6.1 | 2019-12-18 | The image thumbnailing handler in Zulip Server versions 1.9.0 to before 2.0.8 allowed an open redirect that was visible to logged-in users. |
CVE-2019-18933 | Critical | 9.8 | 2019-11-21 | In Zulip Server versions from 1.7.0 to before 2.0.7, a bug in the new user signup process meant that users who registered their account using social authentica… |
CVE-2019-16216 | Medium | 5.4 | 2019-09-18 | Zulip server before 2.0.5 incompletely validated the MIME types of uploaded files. A user who is logged into the server could upload files of certain types to… |
CVE-2019-16215 | Medium | 6.5 | 2019-09-18 | The Markdown parser in Zulip server before 2.0.5 used a regular expression vulnerable to exponential backtracking. A user who is logged into the server could s… |
CVE-2018-9999 | Medium | 5.4 | 2018-04-18 | In Zulip Server versions before 1.7.2, there was an XSS issue with user uploads and the (default) LOCAL_UPLOADS_DIR storage backend. |
CVE-2018-9990 | Medium | 6.1 | 2018-04-18 | In Zulip Server versions before 1.7.2, there was an XSS issue with stream names in topic typeahead. |
CVE-2018-9987 | Medium | 6.1 | 2018-04-18 | In Zulip Server versions 1.5.x, 1.6.x, and 1.7.x before 1.7.2, there was an XSS issue with muting notifications. |
CVE-2018-9986 | Medium | 6.1 | 2018-04-18 | In Zulip Server versions before 1.7.2, there were XSS issues with the frontend markdown processor. |
CVE-2017-0910 | High | 8.8 | 2017-11-27 | In Zulip Server before 1.7.1, on a server with multiple realms, a vulnerability in the invitation system lets an authorized user of one realm on the server cre… |
CVE-2017-0896 | Medium | 6.5 | 2017-06-02 | Zulip Server 1.5.1 and below suffer from an error in the implementation of the invite_by_admins_only setting in the Zulip group chat application server that al… |
CVE-2017-0881 | Medium | 4.3 | 2017-03-28 | An error in the implementation of an autosubscribe feature in the check_stream_exists route of the Zulip group chat application server before 1.4.3 allowed an… |