What the vulnerability does

01Description

Zulip Server 1.5.1 and below suffer from an error in the implementation of the invite_by_admins_only setting in the Zulip group chat application server that allowed an authenticated user to invite other users to join a Zulip organization even if the organization was configured to prevent this.

Key dates

02Disclosure timeline

June 2, 2017 CVE published
August 5, 2024 Record updated