CVE-2022-31017

Zulip is an open-source team collaboration tool. Versions 2.1.0 through and including 5.2 are vulnerable to a logic error. A stream configured as private with protected history, where new subscribers should not be allowed to see messages sent before they were subscribed, when edited causes the server to incorrectly send an API event that includes the edited message to all of the stream’s current subscribers. This API event is ignored by official clients, but can be observed by using a modified client or the browser’s developer tools. This bug will be fixed in Zulip Server 5.3. There are no known workarounds.

• CWE-571
• CWE-670

• https://github.com/zulip/zulip/security/advisories/GHSA-m5j3-jp59-6f3qThird Party Advisory
• https://github.com/zulip/zulip/security/advisories/GHSA-m5j3-jp59-6f3qThird Party Advisory

Published

Jun 25, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-31011TiDB is an open-source NewSQL database that supports Hybrid …7.8
• CVE-2022-31012Git for Windows is a fork of Git that contains Windows-speci…7.3
• CVE-2022-31013Chat Server is the chat server for Vartalap, an open-source …9.8
• CVE-2022-31014Nextcloud server is an open source personal cloud server. Af…3.5
• CVE-2022-31015Waitress is a Web Server Gateway Interface server for Python…5.9
• CVE-2022-31016Argo CD is a declarative continuous deployment for Kubernete…6.5
• CVE-2022-31018Play Framework is a web framework for Java and Scala. A deni…7.5
• CVE-2022-31019Vapor is a server-side Swift HTTP web framework. When using …7.5
• CVE-2022-31020Indy Node is the server portion of a distributed ledger purp…8.8
• CVE-2022-31021Ursa is a cryptographic library for use with blockchains. A …5.3
• CVE-2022-31022Bleve is a text indexing library for go. Bleve includes HTTP…5.5
• CVE-2022-31023Play Framework is a web framework for Java and Scala. Verion…7.5