CVE-2022-31017

Expression Always True vulnerability in Zulip Server

State: Published
Severity: 2.0 Low
Published: Jun 25, 2022
Updated: Apr 23, 2025
Reserved: May 18, 2022

Description

Zulip is an open-source team collaboration tool. Versions 2.1.0 through and including 5.2 are vulnerable to a logic error. A stream configured as private with protected history, where new subscribers should not be allowed to see messages sent before they were subscribed, when edited causes the server to incorrectly send an API event that includes the edited message to all of the stream’s current subscribers. This API event is ignored by official clients, but can be observed by using a modified client or the browser’s developer tools. This bug will be fixed in Zulip Server 5.3. There are no known workarounds.

Scores

CVSS	Score	Vector	Source
3.1	2.0 Low	CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N	GitHub_M

Weaknesses

CWE-571 Expression is Always True
CWE-670 Always-Incorrect Control Flow Implementation

Affected Products

Product	Versions
zulipzulip	>= 2.1.0, < 5.3Affected

References

https://github.com/zulip/zulip/security/advisories/GHSA-m5j3-jp59-6f3q

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.