CVE-2023-28623

Zulip is an open-source team collaboration tool with unique topic-based threading. In the event that 1: `ZulipLDAPAuthBackend` and an external authentication backend (any aside of `ZulipLDAPAuthBackend` and `EmailAuthBackend`) are the only ones enabled in `AUTHENTICATION_BACKENDS` in `/etc/zulip/settings.py` and 2: The organization permissions don't require invitations to join. An attacker can create a new account in the organization with an arbitrary email address in their control that's not in the organization's LDAP directory. The impact is limited to installations which have this specific combination of authentication backends as described above in addition to having `Invitations are required for joining this organization` organization permission disabled. This issue has been addressed in version 6.2. Users are advised to upgrade. Users unable to upgrade may enable the `Invitations are required for joining this organization` organization permission to prevent this issue.

• CWE-285
• CWE-862
• CWE-862

• https://github.com/zulip/zulip/commit/3df1b4dd7c210c21deb6f829df19412b74573f8dPatch, Third Party Advisory
• https://github.com/zulip/zulip/security/advisories/GHSA-7p62-pjwg-56rvThird Party Advisory
• https://github.com/zulip/zulip/commit/3df1b4dd7c210c21deb6f829df19412b74573f8dPatch, Third Party Advisory
• https://github.com/zulip/zulip/security/advisories/GHSA-7p62-pjwg-56rvThird Party Advisory

Published

May 19, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-28618Cross-Site Request Forgery (CSRF) vulnerability in Marios Al…8.8
• CVE-2023-28619Missing Authorization vulnerability in bnayawpguy Resoto all…4.3
• CVE-2023-2862A vulnerability, which was classified as problematic, was fo…6.1
• CVE-2023-28620Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerabili…4.8
• CVE-2023-28621Improper Neutralization of Input During Web Page Generation …6.1
• CVE-2023-28622Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerabil…5.4
• CVE-2023-28625mod_auth_openidc is an authentication and authorization modu…7.5
• CVE-2023-28626comrak is a CommonMark + GFM compatible Markdown parser and …7.5
• CVE-2023-28627pymedusa is an automatic video library manager for TV Shows.…8.8
• CVE-2023-28628lambdaisland/uri is a pure Clojure/ClojureScript URI library…6.1
• CVE-2023-28629GoCD is an open source continuous delivery server. GoCD vers…5.4
• CVE-2023-2863A vulnerability has been found in Simple Design Daily Journa…5.5