High severity · published Jul 22, 2022
CVE-2022-31168
Zulip Server insufficient authorization for changing bot roles
8.8
CVSS
0.8%
EPSS
No
On KEV
Description
Zulip is an open source team chat tool. Due to an incorrect authorization check in Zulip Server 5.4 and earlier, a member of an organization could craft an API call that grants organization administrator privileges to one of their bots. The vulnerability is fixed in Zulip Server 5.5. Members who don’t own any bots, and lack permission to create them, can’t exploit the vulnerability. As a workaround for the vulnerability, an organization administrator can restrict the `Who can create bots` permission to administrators only, and change the ownership of existing bots.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 57% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ZU
zulip · zulip
< 5.5 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-31168
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-31168
Patch
https://github.com/zulip/zulip/commit/751b2a03e565e9eb02ffe923b7c24ac73d604034
Release Notes
https://github.com/zulip/zulip/releases/tag/5.5
Third Party Advisory
https://github.com/zulip/zulip/security/advisories/GHSA-c3cp-ggg5-9xw5
More from zulip
9.8
CVE-2022-21706
Multi-use invitations can grant access to other organizations in Zulip
9.8
CVE-2021-43799
RabbitMQ exposes ports with weak default secrets in Zulip Server
9.1
CVE-2026-102893
Zulip: OpenID Connect authentication ignores the email_verified claim
8.8
CVE-2021-3967
Improper Access Control in zulip/zulip
8.2
CVE-2025-31478
Zulip Authentication Backend Configuration Bypass