Guests in organizations with restricted user visibility can gain access to profile information of other users
Summary
Impact
In organizations that restrict guests' ability to view other users, using the
Who can view all other users in the organization organization setting, a guest
could gain access to the profile information of any user in the organization,
bypassing that restriction.
Organizations...
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| Zulip server |
>=8.0 |
12.2 |
Original description The description as published by the source.
Impact
In organizations that restrict guests' ability to view other users, using the
Who can view all other users in the organization organization setting, a guest
could gain access to the profile information of any user in the organization,
bypassing that restriction.
Organizations that do not restrict guests' access to other users are unaffected.
This was possible since Zulip 8.0, when the setting was introduced.
Details
Saving a direct message draft did not verify that the sender is allowed to access
the draft's recipients.
Patches
Fixed in Zulip server 12.2
Source: GitHub Repository Security Advisories (Game のスタック) GitHub Advisory OSV
References
- GITHUB_REPO_ADVISORY zulip/zulip