Authorization Flaw in Zulip Affects Organization Administrators

CVE-2025-30369

What is CVE-2025-30369?

Zulip, an open-source team collaboration tool, contains a flaw in its API for deleting organization custom profile fields. The security implementation erroneously permits any organization administrator to delete fields belonging to other organizations, compromising data integrity across multiple organizations. This vulnerability has been addressed in Zulip Server version 10.1, where proper checks have been implemented to ensure that only the appropriate organization administrator can delete the relevant field.

References