CVE-2022-31168

Zulip is an open source team chat tool. Due to an incorrect authorization check in Zulip Server 5.4 and earlier, a member of an organization could craft an API call that grants organization administrator privileges to one of their bots. The vulnerability is fixed in Zulip Server 5.5. Members who don’t own any bots, and lack permission to create them, can’t exploit the vulnerability. As a workaround for the vulnerability, an organization administrator can restrict the `Who can create bots` permission to administrators only, and change the ownership of existing bots.

• CWE-285
• CWE-863

• https://github.com/zulip/zulip/commit/751b2a03e565e9eb02ffe923b7c24ac73d604034Patch, Third Party Advisory
• https://github.com/zulip/zulip/releases/tag/5.5Release Notes, Third Party Advisory
• https://github.com/zulip/zulip/security/advisories/GHSA-c3cp-ggg5-9xw5Third Party Advisory
• https://github.com/zulip/zulip/commit/751b2a03e565e9eb02ffe923b7c24ac73d604034Patch, Third Party Advisory
• https://github.com/zulip/zulip/releases/tag/5.5Release Notes, Third Party Advisory
• https://github.com/zulip/zulip/security/advisories/GHSA-c3cp-ggg5-9xw5Third Party Advisory

Published

Jul 22, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-31161Roxy-WI is a Web interface for managing HAProxy, Nginx and K…9.8
• CVE-2022-31162Slack Morphism is an async client library for Rust. Prior to…7.5
• CVE-2022-31163TZInfo is a Ruby library that provides access to time zone d…8.1
• CVE-2022-31164Tovy is a a staff management system for Roblox groups. A vul…7.5
• CVE-2022-31166XWiki Platform Old Core is a core package for XWiki Platform…8.8
• CVE-2022-31167XWiki Platform Security Parent POM contains the security API…6.5
• CVE-2022-31169Wasmtime is a standalone runtime for WebAssembly. There is a…7.5
• CVE-2022-3117Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-31170OpenZeppelin Contracts is a library for smart contract devel…7.5
• CVE-2022-31171Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-31172OpenZeppelin Contracts is a library for smart contract devel…7.5
• CVE-2022-31173Juniper is a GraphQL server library for Rust. Affected versi…7.5