« Volver al listado

CVE-2026-25741

Estado: AplazadaAlta (7.1)—

Zulip is an open-source team collaboration tool. Prior to commit bf28c82dc9b1f630fa8e9106358771b20a0040f7, the API endpoint for creating a card update session during an upgrade flow was accessible to users with only organization member privileges. When the associated Stripe Checkout session is completed, the Stripe webhook updates the organization’s default payment method. Because no billing-specific authorization check is enforced, a regular (non-billing) member can change the organization’s payment method. This vulnerability affected the Zulip Cloud payment processing system, and has been patched as of commit bf28c82dc9b1f630fa8e9106358771b20a0040f7. Self-hosted deploys are no longer affected and no patch or upgrade is required for them.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Acceso red con privilegios (PR:L) a endpoint API sin autorización de facturación. Impacto: modificación no autorizada del método de pago (T1565.002) y potencial abuso de cuenta (T1078).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementApplication Developer GuidanceActive Directory ConfigurationVulnerability ScanningUser TrainingUser Account Management

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Zulip — ZulipAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-25741",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-25741",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-03-03T20:37:25.362868Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 4.2,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "zulip",
          "product": "zulip",
          "versions": [
            {
              "status": "affected",
              "version": "< bf28c82dc9b1f630fa8e9106358771b20a0040f7"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-02-26T22:20:46.170",
  "references": [
    {
      "url": "https://github.com/zulip/zulip/commit/bf28c82dc9b1f630fa8e9106358771b20a0040f7",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/zulip/zulip/security/advisories/GHSA-vhhx-84f7-rc8j",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Zulip is an open-source team collaboration tool. Prior to commit bf28c82dc9b1f630fa8e9106358771b20a0040f7, the API endpoint for creating a card update session during an upgrade flow was accessible to users with only organization member privileges. When the associated Stripe Checkout session is completed, the Stripe webhook updates the organization’s default payment method. Because no billing-specific authorization check is enforced, a regular (non-billing) member can change the organization’s payment method. This vulnerability affected the Zulip Cloud payment processing system, and has been patched as of commit bf28c82dc9b1f630fa8e9106358771b20a0040f7. Self-hosted deploys are no longer affected and no patch or upgrade is required for them."
    },
    {
      "lang": "es",
      "value": "Zulip es una herramienta de colaboración en equipo de código abierto. Antes del commit bf28c82dc9b1f630fa8e9106358771b20a0040f7, el endpoint de la API para crear una sesión de actualización de tarjeta durante un flujo de actualización era accesible para usuarios con solo privilegios de miembro de la organización. Cuando la sesión de Stripe Checkout asociada se completa, el webhook de Stripe actualiza el método de pago predeterminado de la organización. Debido a que no se aplica una verificación de autorización específica de facturación, un miembro regular (no de facturación) puede cambiar el método de pago de la organización. Esta vulnerabilidad afectó al sistema de procesamiento de pagos de Zulip Cloud, y ha sido parcheada a partir del commit bf28c82dc9b1f630fa8e9106358771b20a0040f7. Las implementaciones autoalojadas ya no se ven afectadas y no se requiere ningún parche o actualización para ellas."
    }
  ],
  "lastModified": "2026-06-17T10:25:08.907",
  "sourceIdentifier": "security-advisories@github.com"
}