CVE-2025-27149
CVE-2025-27149 is a low-severity vulnerability in Zulip Zulip Server with a CVSS 3.x base score of 2.7. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-497.
Key facts
- Severity: Low (CVSS 3.x base score 2.7)
- CVSS v4: 4.6
- EPSS exploit prediction: 0% (20th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2025-8854
- Weakness: CWE-497
- Affected product: Zulip Zulip Server
- Published:
- Last modified:
Description
Zulip server provides an open-source team chat that helps teams stay productive and focused. Prior to 10.0, the data export to organization administrators feature in Zulip leaks private data. The collection of user-agent types identifying specific integrations or HTTP libraries (E.g., ZulipGitlabWebhook, okhttp, or PycURL) that have been used to access any organization on the server was incorrectly included in all three export types, regardless of if they were used to access the exported organization or not. The "public data" and "with consent" exports metadata including the titles of some topics in private channels which the administrator otherwise did not have access to, and none of the users consented to exporting and metadata for which users were in a group DM together. This vulnerability is fixed in 10.0.
Frequently asked questions
- What is CVE-2025-27149?
- Zulip server provides an open-source team chat that helps teams stay productive and focused. Prior to 10.0, the data export to organization administrators feature in Zulip leaks private data. The collection of user-agent types identifying specific integrations or HTTP libraries (E.g., ZulipGitlabWebhook, okhttp, or PycURL) that have been used to access any organization on the server was incorrectly included in all three export types, regardless of if they were used to access the exported organization or not. The "public data" and "with consent" exports metadata including the titles of some topics in private channels which the administrator otherwise did not have access to, and none of the users consented to exporting and metadata for which users were in a group DM together. This vulnerability is fixed in 10.0.
- How severe is CVE-2025-27149?
- CVE-2025-27149 has a CVSS 3.x base score of 2.7, rated low severity. It is exploitable over network with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.
- Is CVE-2025-27149 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (20th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2025-27149?
- CVE-2025-27149 affects Zulip Zulip Server. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2025-27149?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- Does CVE-2025-27149 have an EU (EUVD) identifier?
- Yes. CVE-2025-27149 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-8854.
- When was CVE-2025-27149 published?
- CVE-2025-27149 was published on 2025-03-31 and last updated on 2026-06-17.
References
Affected products (1)
- cpe:2.3:a:zulip:zulip_server:*:*:*:*:*:*:*:*
More vulnerabilities in Zulip Zulip Server
- CVE-2019-18933 — Critical (CVSS 9.8): In Zulip Server versions from 1.7.0 to before 2.0.7, a bug in the new user signup process meant that users who…
- CVE-2020-15070 — High (CVSS 8.8): Zulip Server 2.x before 2.1.7 allows eval injection if a privileged attacker were able to write directly to the…
- CVE-2017-0910 — High (CVSS 8.8): In Zulip Server before 1.7.1, on a server with multiple realms, a vulnerability in the invitation system lets an…
- CVE-2025-31478 — High (CVSS 8.2): Zulip is an open-source team collaboration tool. Zulip supports a configuration where account creation is limited…
- CVE-2023-33186 — High (CVSS 8.2): Zulip is an open-source team collaboration tool with unique topic-based threading that combines the best of email and…
- CVE-2024-36612 — High (CVSS 7.5): Zulip from 8.0 to 8.3 contains a memory leak vulnerability in the handling of popovers.
All CVEs affecting Zulip Zulip Server →
Other CWE-497 vulnerabilities
- CVE-2025-10264 — Critical (CVSS 10.0): Certain models of NVR developed by Digiever has an Exposure of Sensitive Information vulnerability, allowing…
- CVE-2026-27494 — Critical (CVSS 9.9): n8n is an open source workflow automation platform. Prior to versions 2.10.1, 2.9.3, and 1.123.22, an authenticated…
- CVE-2025-47699 — Critical (CVSS 9.9): Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497) in the Gallagher Morpho…
- CVE-2025-44823 — Critical (CVSS 9.9): Nagios Log Server before 2024R1.3.2 allows authenticated users to retrieve cleartext administrative API keys via a…
- CVE-2026-14808 — Critical (CVSS 9.8): Prog Management System developed by PROG MIS has a Exposure of Sensitive Information vulnerability, allowing…
- CVE-2024-13999 — Critical (CVSS 9.8): Nagios XI versions prior to 2024R1.1.3, under certain circumstances, disclose the server's Active Directory (AD) or…