CVE-2023-47642

Zulip is an open-source team collaboration tool. It was discovered by the Zulip development team that active users who had previously been subscribed to a stream incorrectly continued being able to use the Zulip API to access metadata for that stream. As a result, users who had been removed from a stream, but still had an account in the organization, could still view metadata for that stream (including the stream name, description, settings, and an email address used to send emails into the stream via the incoming email integration). This potentially allowed users to see changes to a stream’s metadata after they had lost access to the stream. This vulnerability has been addressed in version 7.5 and all users are advised to upgrade. There are no known workarounds for this issue.

• CWE-200

• https://github.com/zulip/zulip/commit/6336322d2f9bbccaacfc80cba83a3c62eefd5737Patch
• https://github.com/zulip/zulip/security/advisories/GHSA-c9wc-65fh-9x8pVendor Advisory
• https://github.com/zulip/zulip/commit/6336322d2f9bbccaacfc80cba83a3c62eefd5737Patch
• https://github.com/zulip/zulip/security/advisories/GHSA-c9wc-65fh-9x8pVendor Advisory

Published

Nov 16, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-47637Pimcore is an Open Source Data & Experience Management Platf…8.8
• CVE-2023-47638Rejected reason: Confirm reference is not public.
• CVE-2023-47639API Platform Core is a system to create hypermedia-driven RE…5.3
• CVE-2023-4764Incorrect security UI in BFCache in Google Chrome prior to 1…6.5
• CVE-2023-47640DataHub is an open-source metadata platform. The HMAC signat…8.8
• CVE-2023-47641aiohttp is an asynchronous HTTP client/server framework for …6.5
• CVE-2023-47643SuiteCRM is a Customer Relationship Management (CRM) softwar…5.3
• CVE-2023-47644Cross-Site Request Forgery (CSRF) vulnerability in profilegr…8.8
• CVE-2023-47645Cross-Site Request Forgery (CSRF) vulnerability in Registrat…8.8
• CVE-2023-47646Auth. (Shop Manager+) Stored Cross-Site Scripting (XSS) vuln…4.8
• CVE-2023-47647Missing Authorization vulnerability in LearningTimes BadgeOS…4.3
• CVE-2023-47648Missing Authorization vulnerability in Spider Themes EazyDoc…7.5