CVE-2022-31168

    Dashboard / Vulnerabilities / CVE-2022-31168

    CVE-2022-31168

    Published: 22 Jul 2022Last Modified: 12 Aug 2026

    Summary: Zulip Server insufficient authorization for changing bot roles

    Details: Zulip is an open source team chat tool. Due to an incorrect authorization check in Zulip Server 5.4 and earlier, a member of an organization could craft an API call that grants organization administrator privileges to one of their bots. The vulnerability is fixed in Zulip Server 5.5. Members who don’t own any bots, and lack permission to create them, can’t exploit the vulnerability. As a workaround for the vulnerability, an organization administrator can restrict the `Who can create bots` permission to administrators only, and change the ownership of existing bots.

    References: https://github.com/zulip/zulip/releases/tag/5.5, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31168.json, https://github.com/zulip/zulip/security/advisories/GHSA-c3cp-ggg5-9xw5, https://nvd.nist.gov/vuln/detail/CVE-2022-31168, https://github.com/zulip/zulip/commit/751b2a03e565e9eb02ffe923b7c24ac73d604034

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -e74582838ff9c7258082b4c1315a8175290dbc17

    Affected versions

    5.4

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-31168 | CVE-DB