Multi-use invitations can grant access to other organizations in Zulip

RabbitMQ exposes ports with weak default secrets in Zulip Server

Zulip: OpenID Connect authentication ignores the email_verified claim

Zulip Server insufficient authorization for changing bot roles

Improper Access Control in zulip/zulip

Zulip Authentication Backend Configuration Bypass

Zulip from 8.0 to 8.3 contains a memory leak vulnerability in the handling of popovers

In zulip before 1.3.12, deactivated users could access messages if SSO was enabled

Race condition in Zulip

Zulip Vulnerable to Modification of Payment Method (Stripe Default Card) by Non-Billing Users

Zulip: Guests can read new messages in non-subscribed public channels

Zulip: Message edit history visible in "moves only" policy through /api/v1/messages/{id}/history

Moving single messages from public to private streams leaves them accessible

Zulip vulnerable to insufficient authorization check for edition/deletion of messages and topics in private streams by former subscribers

Regular expression denial-of-service in Zulip

Zulip: Path Traversal in Import

Cross-site scripting vulnerability in Zulip Server development branch via topic tooltip

Crafted link in Zulip message can cause disclosure of credentials

Zulip affected by Stored XSS in user profile modal

Zulip XSS in digest preview URL

Zulip 8.3 is vulnerable to Cross Site Scripting (XSS) via the construct_copy_div function in copy_and_paste.js

Zulip 8.3 is vulnerable to Cross Site Scripting (XSS) via the replace_emoji_with_text function in ui_util.ts

Cross-site scripting vulnerability in Zulip Server

Cross-site Scripting (XSS) - Stored in zulip/zulip

Zulip: Anonymous File Access After Disabling Spectator Access

Zulip Server has access control bypass for restrictions on creation of specific channel types

/api/v1/jwt/fetch_api_key endpoint can leak if an email address has an account in Zulip server

Ineffective expiration validation for invitation links in Zulip

Zulip Server public data export contains attachments that are non-public

User uploads proxied from S3 lack `Content-Security-Policy` headers, may be served with `Content-Disposition: inline` in zulip

Zulip events can leak private channel names

Zulip non-admins can invite new users to streams they would not otherwise be able to add existing users to

Stream description leaks to ex-subscribers in Zulip

IP address leak via image proxy bypass in Zulip Server

In zulip before 1.3.12, bot API keys were accessible to other users in the same realm

Unauthorized user can register an account in specific configurations in Zulip

Non-constant-time SCIM token comparison in Zulip Server

Users who can send invitations can erroneously add users to streams during invitation in Zulip

Zulip allows the deletion of Custom profile fields by administrators of a different organization

Zulip allows the deletion of organization by administrators of a different organization

Zulip exports can leak private data

Expression Always True vulnerability in Zulip Server