What is the CVSS score of CVE-2026-25741?

CVE-2026-25741 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of Zulip are affected by CVE-2026-25741?

Zulip installations face unauthorized access risk where regular organization members can initiate card update sessions intended only for administrators during upgrade operations.

How to fix or mitigate CVE-2026-25741?

Within 24 hours: inventory all Zulip instances and verify current versions against the vulnerable commit; disable upgrade functionality if possible or restrict access to administrators only. Within 7 days: implement network-level access controls to limit card update session API endpoints to administrative users via reverse proxy or WAF rules; notify users to report suspicious upgrade activity. Within 30 days: monitor vendor repositories for patch availability and prepare deployment plan; conduct access logs review for unauthorized session creation attempts.

Zulip CVE-2026-25741

HIGH

Incorrect Authorization (CWE-863)

2026-02-26 security-advisories@github.com

Authentication Bypass

7.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:56 vuln.today

CVE Published

Feb 26, 2026 - 22:20 nvd

HIGH 7.1

DescriptionGitHub Advisory

Zulip is an open-source team collaboration tool. Prior to commit bf28c82dc9b1f630fa8e9106358771b20a0040f7, the API endpoint for creating a card update session during an upgrade flow was accessible to users with only organization member privileges. When the associated Stripe Checkout session is completed, the Stripe webhook updates the organization’s default payment method. Because no billing-specific authorization check is enforced, a regular (non-billing) member can change the organization’s payment method. This vulnerability affected the Zulip Cloud payment processing system, and has been patched as of commit bf28c82dc9b1f630fa8e9106358771b20a0040f7. Self-hosted deploys are no longer affected and no patch or upgrade is required for them.

AnalysisAI

Zulip's payment method update API endpoint in the upgrade flow lacks proper authorization checks, allowing any organization member to modify the default payment method by completing a Stripe Checkout session. This vulnerability affected Zulip Cloud users and has been patched; self-hosted deployments are not impacted and require no action.

Technical ContextAI

Classified as CWE-863 (Incorrect Authorization). Zulip is an open-source team collaboration tool. Prior to commit bf28c82dc9b1f630fa8e9106358771b20a0040f7, the API endpoint for creating a card update session during an upgrade flow was accessible to users with only organization member privileges. When the associated Stripe Checkout session is completed, the Stripe webhook updates the organization’s default payment method. Because no billing-specific authorization check is enforced, a regular (non-billing) member can change the organization’s pa