Zulip Zulip_server
40 CVEs affecting Zulip Zulip_server. Latest disclosed: 2026-05-12. Critical: 1, High: 7.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-18933 | Critical | 9.8 | 2019-11-21 | In Zulip Server versions from 1.7.0 to before 2.0.7, a bug in the new user signup process meant that users who registered their account using social authentica… |
CVE-2020-15070 | High | 8.8 | 2020-08-21 | Zulip Server 2.x before 2.1.7 allows eval injection if a privileged attacker were able to write directly to the postgres database, and chose to write a crafted… |
CVE-2017-0910 | High | 8.8 | 2017-11-27 | In Zulip Server before 1.7.1, on a server with multiple realms, a vulnerability in the invitation system lets an authorized user of one realm on the server cre… |
CVE-2025-31478 | High | 8.2 | 2025-04-16 | Zulip is an open-source team collaboration tool. Zulip supports a configuration where account creation is limited solely by being able to authenticate with a s… |
CVE-2023-33186 | High | 8.2 | 2023-05-30 | Zulip is an open-source team collaboration tool with unique topic-based threading that combines the best of email and chat to make remote work productive and d… |
CVE-2024-36612 | High | 7.5 | 2024-11-29 | Zulip from 8.0 to 8.3 contains a memory leak vulnerability in the handling of popovers. |
CVE-2020-14215 | High | 7.5 | 2020-08-21 | Zulip Server before 2.1.5 has Incorrect Access Control because 0198_preregistrationuser_invited_as adds the administrator role to invitations. |
CVE-2022-21706 | High | 7.2 | 2022-02-26 | Zulip is an open-source team collaboration tool with topic-based threading. Zulip Server version 2.0.0 and above are vulnerable to insufficient access control… |
CVE-2025-52559 | Medium | 6.8 | 2025-07-02 | Zulip is an open-source team chat application. From versions 2.0.0-rc1 to before 10.4 in Zulip Server, the /digest/ URL of a server shows a preview of what the… |
CVE-2026-40300 | Medium | 6.5 | 2026-05-12 | Zulip is an open-source team collaboration tool. Prior to 12.0, With message_edit_history_visibility_policy set to "moves", /api/v1/messages/{id}/history still… |
CVE-2024-27286 | Medium | 6.5 | 2024-03-20 | Zulip is an open-source team collaboration tool. When a user moves a Zulip message, they have the option to move all messages in the topic, move only subsequen… |
CVE-2023-32678 | Medium | 6.5 | 2023-08-25 | Zulip is an open-source team collaboration tool with topic-based threading that combines email and chat. Users who used to be subscribed to a private stream an… |
CVE-2019-16215 | Medium | 6.5 | 2019-09-18 | The Markdown parser in Zulip server before 2.0.5 used a regular expression vulnerable to exponential backtracking. A user who is logged into the server could s… |
CVE-2017-0896 | Medium | 6.5 | 2017-06-02 | Zulip Server 1.5.1 and below suffer from an error in the implementation of the invite_by_admins_only setting in the Zulip group chat application server that al… |
CVE-2020-12759 | Medium | 6.1 | 2020-08-21 | Zulip Server before 2.1.5 allows reflected XSS via the Dropbox webhook. |
CVE-2020-9445 | Medium | 6.1 | 2020-04-20 | Zulip Server before 2.1.3 allows XSS via the modal_link feature in the Markdown functionality. |
CVE-2020-9444 | Medium | 6.1 | 2020-04-20 | Zulip Server before 2.1.3 allows reverse tabnabbing via the Markdown functionality. |
CVE-2019-19775 | Medium | 6.1 | 2019-12-18 | The image thumbnailing handler in Zulip Server versions 1.9.0 to before 2.0.8 allowed an open redirect that was visible to logged-in users. |
CVE-2018-9990 | Medium | 6.1 | 2018-04-18 | In Zulip Server versions before 1.7.2, there was an XSS issue with stream names in topic typeahead. |
CVE-2018-9987 | Medium | 6.1 | 2018-04-18 | In Zulip Server versions 1.5.x, 1.6.x, and 1.7.x before 1.7.2, there was an XSS issue with muting notifications. |