PT-2024-21794 · Zulip · Zulip

Alexmv · Published 2024-03-20 · Updated 2025-09-03 · CVE-2024-27286

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zulip versions 3.0 through 8.2

Description The issue arises when a user moves a Zulip message from a public stream to a private stream, and chooses to move just that single message. In such cases, active users without access to the private stream, but whose client had already received the message, would continue to see the message in the public stream until they reloaded their client. Furthermore, Zulip did not remove view permissions on the message from recently-active users, allowing the message to show up in the "All messages" view or in search results. This bug has been present since version 3.0, but became more common starting in Zulip 8.0.

Recommendations For Zulip versions 3.0 through 8.2, upgrade to Zulip Server 8.3 to resolve the issue. As a temporary workaround, consider reloading the client to ensure the message is no longer visible in the public stream. Restrict access to moved messages to minimize the risk of information disclosure until the issue is resolved.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2024-27286

GHSA-478X-RFQR-W4JF

Affected Products

Zulip

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/27xxx/CVE-2024-27286.json · Exploit
• https://github.com/zulip/zulip/commit/3db1733310ddd944c2e690ba673232345c928eec · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-27286 · Security Note
• https://osv.dev/vulnerability/CVE-2024-27286 · Vendor Advisory
• https://github.com/zulip/zulip/security/advisories/GHSA-478x-rfqr-w4jf · Note
• https://twitter.com/oktsec/status/1771537828947558634 · Twitter Post
• https://t.me/cveNotify/134178 · Telegram Post
• https://t.me/cvenotify/74291 · Telegram Post
• https://t.me/cvenotify/117061 · Telegram Post