CVE-2023-32678

Zulip is an open-source team collaboration tool with topic-based threading that combines email and chat. Users who used to be subscribed to a private stream and have been removed from it since retain the ability to edit messages/topics, move messages to other streams, and delete messages that they used to have access to, if other relevant organization permissions allow these actions. For example, a user may be able to edit or delete their old messages they posted in such a private stream. An administrator will be able to delete old messages (that they had access to) from the private stream. This issue was fixed in Zulip Server version 7.3.

• CWE-285

• https://github.com/zulip/zulip/security/advisories/GHSA-q3wg-jm9p-35fjThird Party Advisory
• https://zulip.readthedocs.io/en/latest/overview/changelog.html#zulip-server-7-3Release Notes
• https://github.com/zulip/zulip/security/advisories/GHSA-q3wg-jm9p-35fjThird Party Advisory
• https://zulip.readthedocs.io/en/latest/overview/changelog.html#zulip-server-7-3Release Notes

Published

Aug 25, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-32672An Incorrect authorisation check in SQLLab in Apache Superse…4.3
• CVE-2023-32673Certain versions of HP PC Hardware Diagnostics Windows, HP I…9.8
• CVE-2023-32674Certain versions of HP PC Hardware Diagnostics Windows are p…9.8
• CVE-2023-32675Vyper is a pythonic Smart Contract Language for the ethereum…5.3
• CVE-2023-32676Autolab is a course management service that enables auto-gra…7.2
• CVE-2023-32677Zulip is an open-source team collaboration tool with unique …3.1
• CVE-2023-32679Craft CMS is an open source content management system. In af…7.2
• CVE-2023-3268An out of bounds (OOB) memory access flaw was found in the L…7.1
• CVE-2023-32680Metabase is an open source business analytics engine. To edi…9.6
• CVE-2023-32681Requests is a HTTP library. Since Requests 2.3.0, Requests h…6.1
• CVE-2023-32682Synapse is a Matrix protocol homeserver written in Python wi…5.4
• CVE-2023-32683Synapse is a Matrix protocol homeserver written in Python wi…5.4