PT-2025-13806 · Unknown · Zulip Server

Bechar Thakor · Published 2025-03-31 · Updated 2025-08-27 · CVE-2025-30369

Positive Technologies (AI Summary)

CVSS v3.1

2.7

Low

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Zulip Server versions prior to 10.1

Description The issue concerns the API for deleting an organization custom profile field in Zulip, an open-source team collaboration tool. The API handler failed to check if the field belongs to the same organization as the user, allowing an administrator of any organization to delete custom profile fields belonging to a different organization.

Recommendations For versions prior to 10.1, update to Zulip Server 10.1 to resolve the issue. As a temporary workaround, consider restricting access to the API endpoint for deleting organization custom profile fields to prevent unauthorized deletion.

Exploit

Fix

LPE

Weakness Enumeration

CWE-566

Related Identifiers

CVE-2025-30369

GHSA-FCGX-Q63F-7GW4

Affected Products

Zulip Server

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/30xxx/CVE-2025-30369.json · Exploit
• https://github.com/zulip/zulip/security/advisories/GHSA-fcgx-q63f-7gw4 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-30369 · Security Note
• https://osv.dev/vulnerability/CVE-2025-30369 · Vendor Advisory
• https://t.me/cveNotify/133632 · Telegram Post
• https://t.me/cvetracker/20375 · Telegram Post
• https://t.me/cvedetector/21639 · Telegram Post
• https://twitter.com/CVEnew/status/1906752623363211755 · Twitter Post