CVE-2025-30368: Zulip allows the deletion of organization by administrators of a different organization
Zulip is an open-source team collaboration tool. The API for deleting an organization export is supposed to be restricted to organization administrators, but its handler failed to check that the field belongs to the same organization as the user. Therefore, an administrator of any organization was incorrectly allowed to delete an export of a different organization. This is fixed in Zulip Server 10.1.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-30368?
CVE-2025-30368 is classified as a high severity vulnerability due to improper access control in the organization export API.
How do I fix CVE-2025-30368?
To fix CVE-2025-30368, update your Zulip Server to version 10.1 or later to ensure proper access controls are implemented.
Who is affected by CVE-2025-30368?
CVE-2025-30368 affects all versions of Zulip Server prior to 10.1 that allow organization administrators to delete organization exports without proper restrictions.
What kind of attack does CVE-2025-30368 allow?
CVE-2025-30368 allows an attacker to potentially delete organization exports from databases they should not have access to.
Is there a workaround for CVE-2025-30368?
Currently, there are no specific workarounds for CVE-2025-30368; upgrading to the patched version is recommended.