CVE-2021-30478

Published: Apr 15, 2021Modified: Jun 17, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Exploitability: 2.8 / Impact: 1.4

Source: NVD

Description

An issue was discovered in Zulip Server before 3.4. A bug in the implementation of the can_forge_sender permission (previously is_api_super_user) resulted in users with this permission being able to send messages appearing as if sent by a system bot, including to other organizations hosted by the same Zulip installation.

Affected (1)

Products: Zulip: Zulip Server

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Zulip Zulip Server	Before 3.4

Related CWEs

Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

References (2)

https://blog.zulip.com/2021/04/14/zulip-server-3-4/

Source: cve@mitre.org

Release NotesVendor Advisory

https://blog.zulip.com/2021/04/14/zulip-server-3-4/

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesVendor Advisory

Timeline

No history available yet.