Zulip Server vulnerabilities

Zulip Server versions through 12.1 allow guest users to receive new message events for public channels outside their subscriptions. A guest can register an event queue requesting messages from an unsubscribed public channel, or an existing queue can remain affected after access is removed, disclosing new public-channel messages to the guest.

In Zulip Server before 1.7.1, a vulnerability in the invitation system allows an authorized user from one realm on the server to create a user account in any other realm.

Zulip Server through 12.1 has a vulnerability in GenericOpenIdConnectBackend that does not reject an explicitly false email_verified claim, allowing login to an existing account if a misconfigured trusted identity provider returns an email address not controlled by the user.

Zulip, a team collaboration tool, has a cross-site scripting (XSS) vulnerability in tooltips on the message feed. An attacker can craft a malicious topic for a message that, when hovered over by a victim, executes JavaScript code controlled by the attacker.