zulip vulnerabilities
CVEs whose affected-version data names the zulip package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
4 CVEsRSS
CVE-2026-102893Critical· 9.1Zulip is an open-source team collaboration tool
Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, GenericOpenIdConnectBackend matches the identity provider email claim to an active account's delivery_email without rejecting an explicitly false ema…
CVE-2026-100404Medium· 6.5Zulip is an open-source team collaboration tool
Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, guest users can receive new message events for public channels outside their subscriptions. A guest can trigger the issue by registering an event que…
CVE-2026-26058Medium· 6.1Zulip is an open-source team collaboration tool
Zulip is an open-source team collaboration tool. From version 1.4.0 to before version 11.6, ./manage.py import reads arbitrary files from the server filesystem via path traversal in uploads/records.json. A crafted export tarball causes t…
CVE-2026-25742Medium· 5.3Zulip is an open-source team collaboration tool
Zulip is an open-source team collaboration tool. Prior to version 11.6, Zulip is an open-source team collaboration tool. From version 1.4.0 to before version 11.6, even after spectator access (enable_spectator_access / WEB_PUBLIC_STREAMS…