Critical severity · published Nov 21, 2019
CVE-2019-18933
In Zulip Server versions from 1.7.0 to before 2.0.7, a bug in the new user signup process meant that users who registered their account using social authentication (e.g., GitHub…
9.8
CVSS
1.4%
EPSS
No
On KEV
Description
In Zulip Server versions from 1.7.0 to before 2.0.7, a bug in the new user signup process meant that users who registered their account using social authentication (e.g., GitHub or Google SSO) in an organization that also allows password authentication could have their personal API key stolen by an unprivileged attacker, allowing nearly full access to the user's account.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 72% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ZS
Zulip Server · Zulip
1.7.0 before 2.0.7 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-18933
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-18933
Vendor Advisory
https://blog.zulip.org/2019/11/21/zulip-2-0-7-security-release/
Patch
https://github.com/zulip/zulip/commit/0c2cc41d2e40807baa5ee2c72987ebfb64ea2eb6
More from Zulip Server
9.8
CVE-2022-21706
Multi-use invitations can grant access to other organizations in Zulip
8.8
CVE-2020-15070
Zulip Server 2.x before 2.1.7 allows eval injection if a privileged attacker were able to write directly to the postgres database, and chose to write a crafted custom profile…
8.8
CVE-2017-0910
In Zulip Server before 1.7.1, on a server with multiple realms, a vulnerability in the invitation system lets an authorized user of one realm on the server create a user account…
8.2
CVE-2025-31478
Zulip Authentication Backend Configuration Bypass
7.5
CVE-2024-36612
Zulip from 8.0 to 8.3 contains a memory leak vulnerability in the handling of popovers