CVE-2024-21630

Zulip is an open-source team collaboration tool. A vulnerability in version 8.0 is similar to CVE-2023-32677, but applies to multi-use invitations, not single-use invitation links as in the prior CVE. Specifically, it applies when the installation has configured non-admins to be able to invite users and create multi-use invitations, and has also configured only admins to be able to invite users to streams. As in CVE-2023-32677, this does not let users invite new users to arbitrary streams, only to streams that the inviter can already see. Version 8.1 fixes this issue. As a workaround, administrators can limit sending of invitations down to users who also have the permission to add users to streams.

• CWE-862

• https://github.com/zulip/zulip/commit/0df7bd71f32f3b772e2646c6ab0d60c9b610addfPatch
• https://github.com/zulip/zulip/security/advisories/GHSA-87p9-wprh-7rm6Vendor Advisory
• https://github.com/zulip/zulip/security/advisories/GHSA-mrvp-96q6-jpvcVendor Advisory
• https://zulip.com/help/configure-who-can-invite-to-streamsProduct
• https://zulip.com/help/restrict-account-creation#change-who-can-send-invitationsProduct
• https://github.com/zulip/zulip/commit/0df7bd71f32f3b772e2646c6ab0d60c9b610addfPatch
• https://github.com/zulip/zulip/security/advisories/GHSA-87p9-wprh-7rm6Vendor Advisory
• https://github.com/zulip/zulip/security/advisories/GHSA-mrvp-96q6-jpvcVendor Advisory
• https://zulip.com/help/configure-who-can-invite-to-streamsProduct
• https://zulip.com/help/restrict-account-creation#change-who-can-send-invitationsProduct

Published

Jan 25, 2024

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-21625SideQuest is a place to get virtual reality applications for…8.8
• CVE-2024-21626runc is a CLI tool for spawning and running containers on Li…8.6
• CVE-2024-21627PrestaShop is an open-source e-commerce platform. Prior to v…6.1
• CVE-2024-21628PrestaShop is an open-source e-commerce platform. Prior to v…6.1
• CVE-2024-21629Rust EVM is an Ethereum Virtual Machine interpreter. In `rus…7.5
• CVE-2024-2163The Ninja Beaver Add-ons for Beaver Builder plugin for WordP…6.4
• CVE-2024-21631Vapor is an HTTP web framework for Swift. Prior to version 4…6.5
• CVE-2024-21632omniauth-microsoft_graph provides an Omniauth strategy for t…9.8
• CVE-2024-21633Apktool is a tool for reverse engineering Android APK files.…7.8
• CVE-2024-21634Amazon Ion is a Java implementation of the Ion data notation…7.5
• CVE-2024-21635Memos is a privacy-first, lightweight note-taking service th…7.5
• CVE-2024-21636view_component is a framework for building reusable, testabl…6.1