CVE-2024-56136

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Zulip server provides an open-source team chat that helps teams stay productive and focused. Zulip Server 7.0 and above are vulnerable to an information disclose attack, where, if a Zulip server is hosting multiple organizations, an unauthenticated user can make a request and determine if an email address is in use by a user. Zulip Server 9.4 resolves the issue, as does the `main` branch of Zulip Server. Users are advised to upgrade. There are no known workarounds for this issue.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
zulip	zulip	>= 7.0, < 9.4

References

Timeline

Published: Jan 16, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-561377.2MaxKB, which stands for Max Knowledge Base, is an open source knowledge base question-answering system based on a large language model and r CVE-2024-561384.0notion-go is a collection of libraries for supporting sign and verify OCI artifacts. Based on Notary Project specifications. This issue was CVE-2024-561396.9pdftools is a high level tools to convert PDF files to ePUB formats. In versions up to and including 0.5.0 maliciously crafted epub files ca CVE-2024-56145.3The Piotnet Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, CVE-2024-561406.5Astro is a web framework for content-driven websites. In affected versions a bug in Astro’s CSRF-protection middleware allows requests to by CVE-2024-561415.0Minosoft is an open-source, multi-version Minecraft Java Edition client written in Kotlin. Starting in commit f1ae30e2b046a490026a8413b07568 CVE-2024-561426.5pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores. A vulnerability has been discovere CVE-2024-561438.2Strapi is an open-source headless content management system. In versions from 5.0.0 to before 5.5.2, the lookup operator provided by the doc CVE-2024-561445.4librenms is a community-based GPL-licensed network monitoring system. Affected versions are subject to a stored XSS on the parameters (Repla CVE-2024-561459.8Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Users of affected versions are affecte CVE-2024-56155.3The Open Graph plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.11.2 via the 'op CVE-2024-561569.0Halo is an open source website building tool. Prior to version 2.20.13, a vulnerability in Halo allows attackers to bypass file type validat