Zulip non-admins can invite new users to streams they would not otherwise be able to add existing users to
Summary
Zulip non-admins can invite new users to streams they would not otherwise be able to add existing users to
Original description
The description as published by the source.
Zulip is an open-source team collaboration tool. A vulnerability in version 8.0 is similar to CVE-2023-32677, but applies to multi-use invitations, not single-use invitation links as in the prior CVE. Specifically, it applies when the installation has configured non-admins to be able to invite users and create multi-use invitations, and has also configured only admins to be able to invite users to streams. As in CVE-2023-32677, this does not let users invite new users to arbitrary streams, only to streams that the inviter can already see. Version 8.1 fixes this issue. As a workaround, administrators can limit sending of invitations down to users who also have the permission to add users to streams.
References
- advisory github.com
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web zulip.com
- web zulip.com