CVE-2023-32678

Summary

CVE-2023-32678 affects Zulip, an open-source team collaboration tool. Previously subscribed users, even after being removed from private streams, can still edit messages, move them to other streams, and delete messages they had access to, provided relevant organization permissions allow these actions. This issue could potentially allow users to manipulate old messages in private streams. Although administrators can delete such messages, this vulnerability poses a risk to data integrity and confidentiality. It was addressed in Zulip Server version 7.3.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.