CVE-2019-18933
highpriority · track · 39OT risk · elevatedEPSS 0.014 · 71 %ileEUUSEPSS · scored 2026-10-27
In Zulip Server versions from 1.7.0 to before 2.0.7, a bug in the new user signup process meant that users who registered their account using social authentication (e.g., GitHub or Google SSO) in an organization that also allows password authentication could have their personal API key stolen by an unprivileged attacker, allowing nearly full access to the user's account.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 7.5–9.8
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (2)
Products and version ranges known to be affected.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (7)
External citations — patches, advisories, analysis.
- https://blog.zulip.org/2019/11/21/zulip-2-0-7-security-release/cnnvd
- https://github.com/zulip/zulip/commit/0c2cc41d2e40807baa5ee2c72987ebfb64ea2eb6cnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2019-18933cnnvd
- https://blog.zulip.org/2019/11/21/zulip-2-0-7-security-release/enisa_euvd
- https://github.com/zulip/zulip/commit/0c2cc41d2e40807baa5ee2c72987ebfb64ea2eb6enisa_euvd
- https://blog.zulip.org/2019/11/21/zulip-2-0-7-security-release/Vendor Advisorynvd
- https://github.com/zulip/zulip/commit/0c2cc41d2e40807baa5ee2c72987ebfb64ea2eb6Patchnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan