CVE-2026-25741: Zulip Vulnerable to Modification of Payment Method (Stripe Default Card) by Non-Billing Users
Zulip is an open-source team collaboration tool. Prior to commit bf28c82dc9b1f630fa8e9106358771b20a0040f7, the API endpoint for creating a card update session during an upgrade flow was accessible to users with only organization member privileges. When the associated Stripe Checkout session is completed, the Stripe webhook updates the organization’s default payment method. Because no billing-specific authorization check is enforced, a regular (non-billing) member can change the organization’s payment method. This vulnerability affected the Zulip Cloud payment processing system, and has been patched as of commit bf28c82dc9b1f630fa8e9106358771b20a0040f7. Self-hosted deploys are no longer affected and no patch or upgrade is required for them.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
The issue affected the Zulip Cloud payment processing system. Self-hosted Zulip deployments are no longer affected and do not require a patch or upgrade.
What access does an attacker need to change the payment method?
An attacker needs only organization member privileges; billing-specific privileges are not required. They can access the card update session creation endpoint during an upgrade flow and complete the associated Stripe Checkout session.
What should affected organizations do to determine whether their payment method was changed?
Review the organization’s default payment method in the Zulip Cloud billing and Stripe payment records for unexpected changes. The vulnerability allowed the Stripe webhook to update that default payment method after checkout completion.
Is a mitigation needed if the affected service has already been patched?
The issue was patched in commit bf28c82dc9b1f630fa8e9106358771b20a0040f7. Organizations should still verify their current default payment method if untrusted non-billing members may have had access before the patch.