CVE-2024-27286: Moving single messages from public to private streams leaves them accessible
First published: Wed Mar 20 2024(Updated: )
Zulip is an open-source team collaboration tool. When a user moves a Zulip message, they have the option to move all messages in the topic, move only subsequent messages as well, or move just a single message. If the user chose to just move one message, and was moving it from a public stream to a private stream, Zulip would successfully move the message, -- but active users who did not have access to the private stream, but whose client had already received the message, would continue to see the message in the public stream until they reloaded their client. Additionally, Zulip did not remove view permissions on the message from recently-active users, allowing the message to show up in the "All messages" view or in search results, but not in "Inbox" or "Recent conversations" views. While the bug has been present since moving messages between streams was first introduced in version 3.0, this option became much more common starting in Zulip 8.0, when the default option in the picker for moving the very last message in a conversation was changed. This issue is fixed in Zulip Server 8.3. No known workarounds are available.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Zulip Server | >=3.0<8.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-27286?
CVE-2024-27286 is classified as a medium severity vulnerability affecting Zulip Server.
How do I fix CVE-2024-27286?
To fix CVE-2024-27286, you should update Zulip Server to the latest version that includes the security patch.
What versions of Zulip Server are affected by CVE-2024-27286?
CVE-2024-27286 affects Zulip Server versions from 3.0 to 8.3.
What type of vulnerability is CVE-2024-27286?
CVE-2024-27286 is related to improper handling of message moving operations in Zulip.
Is the vulnerability CVE-2024-27286 exploitable by users?
Yes, CVE-2024-27286 can be exploited by users with the ability to move messages in Zulip.
- agent/weakness
- agent/title
- agent/references
- agent/first-publish-date
- agent/type
- collector/nvd-api
- source/NVD
- agent/severity
- agent/author
- agent/event
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/source
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/description
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- vendor/zulip
- canonical/zulip server