CVE-2021-30478: Zulip Server

Medium severity, CVSS 4.3. EPSS: 0.6% chance of exploitation in the next 30 days.

An issue was discovered in Zulip Server before 3.4. A bug in the implementation of the can_forge_sender permission (previously is_api_super_user) resulted in users with this permission being able to send messages appearing as if sent by a system bot, including to other organizations hosted by the same Zulip installation.

Affected products

• Zulip Zulip Server: before 3.4 (fixed in 3.4)

Published 2021-04-15. Last modified 2026-06-17.