Medium severity · published Jan 16, 2025
CVE-2024-56136
/api/v1/jwt/fetch_api_key endpoint can leak if an email address has an account in Zulip server
5.3
CVSS
0.6%
EPSS
No
On KEV
Description
Zulip server provides an open-source team chat that helps teams stay productive and focused. Zulip Server 7.0 and above are vulnerable to an information disclose attack, where, if a Zulip server is hosting multiple organizations, an unauthenticated user can make a request and determine if an email address is in use by a user. Zulip Server 9.4 resolves the issue, as does the `main` branch of Zulip Server. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 48% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ZU
zulip · zulip
>= 7.0, < 9.4 · source: vendor
ZS
Zulip Server · Zulip
7.0 before 9.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-56136
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-56136
Patch
https://github.com/zulip/zulip/commit/c6334a765b1e6d71760e4a3b32ae5b8367f2ed4d
Third Party Advisory
https://github.com/zulip/zulip/security/advisories/GHSA-5xg8-xhfj-4hm6
More from zulip
9.8
CVE-2022-21706
Multi-use invitations can grant access to other organizations in Zulip
9.8
CVE-2021-43799
RabbitMQ exposes ports with weak default secrets in Zulip Server
9.1
CVE-2026-102893
Zulip: OpenID Connect authentication ignores the email_verified claim
8.8
CVE-2022-31168
Zulip Server insufficient authorization for changing bot roles
8.8
CVE-2021-3967
Improper Access Control in zulip/zulip