Zulip Server 1.5.1 and below suffer from an error in the implementation of the invite_by_admins_only setting in the Zulip group chat applic…

Published 9 y ago 2017-06-02 · modified 4 mo ago 2026-06-17 · JSON

CVSS

6.5

v3.0 · NVD

CISA KEV

not known exploited

EPSS

1.3%

percentile 70%

Public exploits

none known

Zulip Server 1.5.1 and below suffer from an error in the implementation of the invite_by_admins_only setting in the Zulip group chat application server that allowed an authenticated user to invite other users to join a Zulip organization even if the organization was configured to prevent this.

Exploit prediction (EPSS)

1.28% probability of exploitation in the next 30 days, higher than 70% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	6.5	`CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N`
NVD	2.0	4.0	`AV:N/AC:L/Au:S/C:N/I:P/A:N`

Affected products

Zulip Zulip Server

Classification

Weakness

CWE-285 Improper Authorization
CWE-862 Missing Authorization

References

groups.google.com /forum/#%21msg/zulip-announce/sUYeJv-fFmg/2TU2TLmNAwAJ · mailing-list, x_refsource_MLIST, x_transferred
hackerone.com /reports/224210 · x_refsource_MISC, x_transferred
github.com /zulip/zulip/commit/1f48fa27672170bba3b9a97384905bb04c18761b · x_refsource_MISC, x_transferred

Sources

CVE List: CVE-2017-0896
NVD: CVE-2017-0896

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.