{"id":"CVE-2017-0896","details":"Zulip Server 1.5.1 and below suffer from an error in the implementation of the invite_by_admins_only setting in the Zulip group chat application server that allowed an authenticated user to invite other users to join a Zulip organization even if the organization was configured to prevent this.","modified":"2026-08-07T14:48:38.942050Z","published":"2017-06-02T17:29:00.167Z","references":[{"type":"WEB","url":"https://groups.google.com/forum/#%21msg/zulip-announce/sUYeJv-fFmg/2TU2TLmNAwAJ"},{"type":"REPORT","url":"https://hackerone.com/reports/224210"},{"type":"FIX","url":"https://github.com/zulip/zulip/commit/1f48fa27672170bba3b9a97384905bb04c18761b"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/zulip/zulip","events":[{"introduced":"b69c6228af03634061cba29f3aa7200c14e7c626"},{"last_affected":"bd01b1e2e4cac3117d5d042aa7ae686bc0573f9d"},{"fixed":"1f48fa27672170bba3b9a97384905bb04c18761b"}],"database_specific":{"cpe":["cpe:2.3:a:zulip:zulip_server:1.3.0:*:*:*:*:*:*:*","cpe:2.3:a:zulip:zulip_server:1.3.1:*:*:*:*:*:*:*","cpe:2.3:a:zulip:zulip_server:1.3.2:*:*:*:*:*:*:*","cpe:2.3:a:zulip:zulip_server:1.3.3:*:*:*:*:*:*:*","cpe:2.3:a:zulip:zulip_server:1.3.4:*:*:*:*:*:*:*","cpe:2.3:a:zulip:zulip_server:1.3.6:*:*:*:*:*:*:*","cpe:2.3:a:zulip:zulip_server:1.3.7:*:*:*:*:*:*:*","cpe:2.3:a:zulip:zulip_server:1.3.8:*:*:*:*:*:*:*","cpe:2.3:a:zulip:zulip_server:1.3.9:*:*:*:*:*:*:*","cpe:2.3:a:zulip:zulip_server:1.3.10:*:*:*:*:*:*:*","cpe:2.3:a:zulip:zulip_server:1.3.11:*:*:*:*:*:*:*","cpe:2.3:a:zulip:zulip_server:1.3.12:*:*:*:*:*:*:*","cpe:2.3:a:zulip:zulip_server:1.3.13:*:*:*:*:*:*:*","cpe:2.3:a:zulip:zulip_server:1.4.0:*:*:*:*:*:*:*","cpe:2.3:a:zulip:zulip_server:1.4.1:*:*:*:*:*:*:*","cpe:2.3:a:zulip:zulip_server:1.4.2:*:*:*:*:*:*:*","cpe:2.3:a:zulip:zulip_server:1.4.3:*:*:*:*:*:*:*","cpe:2.3:a:zulip:zulip_server:1.5.0:*:*:*:*:*:*:*","cpe:2.3:a:zulip:zulip_server:1.5.1:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"1.3.0"},{"last_affected":"1.3.0"},{"introduced":"1.3.1"},{"last_affected":"1.3.1"},{"introduced":"1.3.2"},{"last_affected":"1.3.2"},{"introduced":"1.3.3"},{"last_affected":"1.3.3"},{"introduced":"1.3.4"},{"last_affected":"1.3.4"},{"introduced":"1.3.6"},{"last_affected":"1.3.6"},{"introduced":"1.3.7"},{"last_affected":"1.3.7"},{"introduced":"1.3.8"},{"last_affected":"1.3.8"},{"introduced":"1.3.9"},{"last_affected":"1.3.9"},{"introduced":"1.3.10"},{"last_affected":"1.3.10"},{"introduced":"1.3.11"},{"last_affected":"1.3.11"},{"introduced":"1.3.12"},{"last_affected":"1.3.12"},{"introduced":"1.3.13"},{"last_affected":"1.3.13"},{"introduced":"1.4.0"},{"last_affected":"1.4.0"},{"introduced":"1.4.1"},{"last_affected":"1.4.1"},{"introduced":"1.4.2"},{"last_affected":"1.4.2"},{"introduced":"1.4.3"},{"last_affected":"1.4.3"},{"introduced":"1.5.0"},{"last_affected":"1.5.0"},{"introduced":"1.5.1"},{"last_affected":"1.5.1"}],"source":["CPE_STRING","REFERENCES"]}}],"versions":["1.3.0","1.3.1","1.3.10","1.3.11","1.3.12","1.3.13","1.3.2","1.3.3","1.3.4","1.3.6","1.3.7","1.3.8","1.3.9","1.4.0","1.4.1","1.4.2","1.4.3","1.5.0","1.5.1","1.3.5"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-0896.json"}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"}]}