Zulip vulnerabilities
We track 6 vulnerabilities in Zulip products across 2 products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on October 14, 2026.
Latest Zulip vulnerabilities
- 9.1 Critical severity
zulip: Improper Authentication
Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, GenericOpenIdConnectBackend matches the identity provider email claim to an active account's delivery_email without rejecting an explicitly false email_verified claim. If a
- 7.1 High severity
zulip: Incorrect Authorization
Zulip is an open-source team collaboration tool. Prior to commit bf28c82dc9b1f630fa8e9106358771b20a0040f7, the API endpoint for creating a card update session during an upgrade flow was accessible to users with only organization member privileges. When the ass
- 8.2 High severity
zulip: Improper Authentication
Zulip is an open-source team collaboration tool. Zulip supports a configuration where account creation is limited solely by being able to authenticate with a single-sign on authentication backend, meaning the organization places no restrictions on email addres
- 8.8 High severity
zulip: Improper Authorization
Zulip is an open source team chat tool. Due to an incorrect authorization check in Zulip Server 5.4 and earlier, a member of an organization could craft an API call that grants organization administrator privileges to one of their bots. The vulnerability is fi
- 7.4 High severity
zulip: Concurrent Execution using Shared Resource with Improper Synchronization
Zulip is an open source group chat application. Starting with version 4.0 and prior to version 4.11, Zulip is vulnerable to a race condition during account deactivation, where a simultaneous access by the user being deactivated may, in rare cases, allow contin
- 9.8 Critical severity
zulip: Improper Access Control
Zulip is an open-source team collaboration tool with topic-based threading. Zulip Server version 2.0.0 and above are vulnerable to insufficient access control with multi-use invitations. A Zulip Server deployment which hosts multiple organizations is vulnerabl