CVE-2017-0896

Published: Jun 2, 2017Modified: May 13, 2026

6.5

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

Zulip Server 1.5.1 and below suffer from an error in the implementation of the invite_by_admins_only setting in the Zulip group chat application server that allowed an authenticated user to invite other users to join a Zulip organization even if the organization was configured to prevent this.

Affected (19)

Products: Zulip: Zulip Server

Zulip

1 product

Zulip Server

Configuration A

19 vulnerable

Vulnerable Software	Affected Versions
Zulip Zulip Server	Version 1.3.0
Zulip Zulip Server	Version 1.3.10
Zulip Zulip Server	Version 1.3.11
Zulip Zulip Server	Version 1.3.12
Zulip Zulip Server	Version 1.3.13
Zulip Zulip Server	Version 1.3.1
Zulip Zulip Server	Version 1.3.2
Zulip Zulip Server	Version 1.3.3
Zulip Zulip Server	Version 1.3.4
Zulip Zulip Server	Version 1.3.6
Zulip Zulip Server	Version 1.3.7
Zulip Zulip Server	Version 1.3.8
Zulip Zulip Server	Version 1.3.9
Zulip Zulip Server	Version 1.4.0
Zulip Zulip Server	Version 1.4.1
Zulip Zulip Server	Version 1.4.2
Zulip Zulip Server	Version 1.4.3
Zulip Zulip Server	Version 1.5.0
Zulip Zulip Server	Version 1.5.1