CVE-2025-30369: Zulip allows the deletion of Custom profile fields by administrators of a different organization
Zulip is an open-source team collaboration tool. The API for deleting an organization custom profile field is supposed to be restricted to organization administrators, but its handler failed to check that the field belongs to the same organization as the user. Therefore, an administrator of any organization was incorrectly allowed to delete custom profile fields belonging to a different organization. This is fixed in Zulip Server 10.1.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-30369?
CVE-2025-30369 has a medium severity rating due to improper access control in the API.
How do I fix CVE-2025-30369?
To fix CVE-2025-30369, update your Zulip Server to version 10.1 or later.
What is the impact of CVE-2025-30369?
CVE-2025-30369 allows a user to delete organization custom profile fields without proper authorization.
Which versions of Zulip Server are affected by CVE-2025-30369?
Zulip Server versions prior to 10.1 are affected by CVE-2025-30369.
Who is at risk from CVE-2025-30369?
Organizations using affected versions of Zulip Server are at risk from CVE-2025-30369.