CVE-2024-21630

Zulip non-admins can invite new users to streams they would not otherwise be able to add existing users to

Description

Zulip is an open-source team collaboration tool. A vulnerability in version 8.0 is similar to CVE-2023-32677, but applies to multi-use invitations, not single-use invitation links as in the prior CVE. Specifically, it applies when the installation has configured non-admins to be able to invite users and create multi-use invitations, and has also configured only admins to be able to invite users to streams. As in CVE-2023-32677, this does not let users invite new users to arbitrary streams, only to streams that the inviter can already see. Version 8.1 fixes this issue. As a workaround, administrators can limit sending of invitations down to users who also have the permission to add users to streams.

Category

4.3
CVSS
Severity: Medium
CVSS 3.1 •
EPSS 0.11%
Vendor Advisory github.com Vendor Advisory github.com
Affected: zulip zulip
Published at:
Updated at:

References

Link Tags
https://github.com/zulip/zulip/security/advisories/GHSA-87p9-wprh-7rm6 vendor advisory
https://github.com/zulip/zulip/security/advisories/GHSA-mrvp-96q6-jpvc vendor advisory
https://github.com/zulip/zulip/commit/0df7bd71f32f3b772e2646c6ab0d60c9b610addf patch
https://zulip.com/help/configure-who-can-invite-to-streams product
https://zulip.com/help/restrict-account-creation#change-who-can-send-invitations product

Frequently Asked Questions

What is the severity of CVE-2024-21630?
CVE-2024-21630 has been scored as a medium severity vulnerability.
How to fix CVE-2024-21630?
To fix CVE-2024-21630, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2024-21630 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2024-21630 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2024-21630?
CVE-2024-21630 affects zulip zulip.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.