CVE-2025-25195: Zulip events can leak private channel names
First published: Thu Feb 13 2025(Updated: )
Zulip is an open source team chat application. A weekly cron job (added in 50256f48314250978f521ef439cafa704e056539) demotes channels to being "inactive" after they have not received traffic for 180 days. However, upon doing so, an event was sent to all users in the organization, not just users in the channel. This event contained the name of the private channel. Similarly, the same commit (50256f48314250978f521ef439cafa704e056539) added functionality to notify clients when channels stopped being "inactive." The first message sent to a private channel which had not previously had any messages for over 180 days (and were thus already marked "inactive") would leak an event to all users in the organization; this event also contained the name of the private channel. Commits 75be449d456d29fef27e9d1828bafa30174284b4 and a2a1a7f8d152296c8966f1380872c0ac69e5c87e fixed the issue. This vulnerability only existed in `main`, and was not part of any published versions.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Zulip Desktop | =main |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/zulip/zulip/commit/50256f48314250978f521ef439cafa704e056539
- https://github.com/zulip/zulip/commit/75be449d456d29fef27e9d1828bafa30174284b4
- https://github.com/zulip/zulip/commit/a2a1a7f8d152296c8966f1380872c0ac69e5c87e
- https://github.com/zulip/zulip/security/advisories/GHSA-x8cx-3hq5-4wj9
Frequently Asked Questions
What is the severity of CVE-2025-25195?
CVE-2025-25195 is classified as a moderate severity vulnerability.
How do I fix CVE-2025-25195?
To fix CVE-2025-25195, ensure that your Zulip instance is updated to the latest version where this issue has been addressed.
What does CVE-2025-25195 affect?
CVE-2025-25195 affects the Zulip open source team chat application, specifically impacting user notifications upon channel demotion.
What is the impact of CVE-2025-25195?
The impact of CVE-2025-25195 includes unintended notifications sent to all organization users when channels are marked inactive.
When was CVE-2025-25195 discovered?
CVE-2025-25195 was introduced in the Zulip application through a commit made in early 2023.
- collector/nvd-api
- source/NVD
- agent/weakness
- agent/references
- agent/author
- agent/description
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/title
- agent/severity
- agent/source
- agent/first-publish-date
- agent/event
- agent/softwarecombine
- agent/tags
- agent/epss
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/epss-latest
- source/FIRST
- vendor/zulip
- canonical/zulip desktop