PT-2025-13805 · Unknown · Zulip Server

Published 2025-03-31 · Updated 2025-08-27 · CVE-2025-30368

Positive Technologies (AI Summary)

CVSS v3.1

2.7

Low

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Zulip Server versions prior to 10.1

Description The issue concerns the API for deleting an organization export in Zulip, an open-source team collaboration tool. The API handler failed to check if the field belongs to the same organization as the user, allowing an administrator of any organization to delete an export of a different organization.

Recommendations For versions prior to 10.1, update to Zulip Server 10.1 to resolve the issue. As a temporary workaround, consider restricting access to the API endpoint for deleting an organization export to prevent unauthorized deletion of exports.

Exploit

Fix

Weakness Enumeration

CWE-566

Related Identifiers

CVE-2025-30368

GHSA-RMHR-5FFQ-QCRC

Affected Products

Zulip Server

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/30xxx/CVE-2025-30368.json · Exploit
• https://github.com/zulip/zulip/commit/07dcee36b2a34d63429d7a706f880628cf3433df · Patch
• https://github.com/zulip/zulip/security/advisories/GHSA-rmhr-5ffq-qcrc · Patch
• https://osv.dev/vulnerability/CVE-2025-30368 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-30368 · Security Note
• https://t.me/cvetracker/20374 · Telegram Post
• https://t.me/cveNotify/133631 · Telegram Post
• https://t.me/cvedetector/21638 · Telegram Post
• https://twitter.com/CVEnew/status/1906752625502195805 · Twitter Post
• https://zulip.readthedocs.io/en/latest/overview/changelog.html#zulip-server-10-1 · Note