CVE-2019-18933 - CVE House
Back to Database
Status published Critical CVE-2019-18933

In Zulip Server versions from 1.7.0 to before 2.0.7, a...

Vulnerability Description

In Zulip Server versions from 1.7.0 to before 2.0.7, a bug in the new user signup process meant that users who registered their account using social authentication (e.g., GitHub or Google SSO) in an organization that also allows password authentication could have their personal API key stolen by an unprivileged attacker, allowing nearly full access to the user's account.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-18933

Credits & Attribution

No credits recorded in the NVD database.

References

More from zulip

View All →
CVE-2025-52559
Zulip XSS in digest preview URL
Medium 6.8
CVE-2025-47930
Zulip Server has access control bypass for restrictions on creation of specific channel types
Medium 5.3
CVE-2025-31478
Zulip Authentication Backend Configuration Bypass
High 8.2
CVE-2025-30369
Zulip allows the deletion of Custom profile fields by administrators of a different organization
Low 2.7
CVE-2025-30368
Zulip allows the deletion of organization by administrators of a different organization
Low 2.7

Affected Vendor

Affected Software

zulip server
Vulnerable Versions:
1.7.0

Timeline

Official Publish: November 21st, 2019
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.