CVE-2017-0881: Zulip Server

Medium severity, CVSS 4.3. EPSS: 1.1% chance of exploitation in the next 30 days.

An error in the implementation of an autosubscribe feature in the check_stream_exists route of the Zulip group chat application server before 1.4.3 allowed an authenticated user to subscribe to a private stream that should have required an invitation from an existing member to join. The issue affects all previously released versions of the Zulip server.

Affected products

• Zulip Zulip Server: before 1.4.3 (fixed in 1.4.3)

Published 2017-03-28. Last modified 2026-06-17.