CVE-2017-0881

An error in the implementation of an autosubscribe feature in the check_stream_exists route of the Zulip group chat application server before 1.4.3 allowed an authenticated user to subscribe to a private stream that should have required an invitation from an existing member to join. The issue affects all previously released versions of the Zulip server.

• CWE-200
• CWE-863

• http://www.securityfocus.com/bid/97159Third Party Advisory, Vendor Advisory
• https://github.com/zulip/zulip/commit/7ecda1ac8e26d8fb3725e954b2dc4723dda2255fPatch, Third Party Advisory
• https://groups.google.com/d/msg/zulip-announce/VyawgRuoY34/NTBwnTArGwAJPatch, Release Notes, Third Party Advisory
• http://www.securityfocus.com/bid/97159Third Party Advisory, Vendor Advisory
• https://github.com/zulip/zulip/commit/7ecda1ac8e26d8fb3725e954b2dc4723dda2255fPatch, Third Party Advisory
• https://groups.google.com/d/msg/zulip-announce/VyawgRuoY34/NTBwnTArGwAJPatch, Release Notes, Third Party Advisory

Published

Mar 28, 2017

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-0874A denial of service vulnerability in the Android media frame…
• CVE-2017-0876A remote code execution vulnerability in the Android media f…
• CVE-2017-0877A remote code execution vulnerability in the Android media f…
• CVE-2017-0878A remote code execution vulnerability in the Android media f…
• CVE-2017-0879An information disclosure vulnerability in the Android media…
• CVE-2017-0880A denial of service vulnerability in the Android media frame…
• CVE-2017-0882Multiple versions of GitLab expose sensitive user credential…
• CVE-2017-0883Nextcloud Server before 9.0.55 and 10.0.2 suffers from a per…
• CVE-2017-0884Nextcloud Server before 9.0.55 and 10.0.2 suffers from a cre…4.3
• CVE-2017-0885Nextcloud Server before 9.0.55 and 10.0.2 suffers from a err…4.3
• CVE-2017-0886Nextcloud Server before 9.0.55 and 10.0.2 suffers from a Den…6.5
• CVE-2017-0887Nextcloud Server before 9.0.55 and 10.0.2 suffers from a byp…4.3