Zulip Server Data Export Vulnerability Prior to 10.0 Allows Unintended Private Data Leakage

A vulnerability in Zulip Server's data export feature for organization administrators, present in versions 2.1.0 through prior to 10.0, unintentionally exposes private data. The issue arises from the incorrect inclusion of user-agent information from various integrations and HTTP libraries in all export types. Additionally, the 'public data' and 'with consent' exports may contain metadata from private channels and group DMs that administrators should not access. This flaw has existed since Zulip Server 2.1.0.

Impact

This vulnerability could lead to unauthorized access to private metadata and user-agent information, potentially revealing details about integrations used within the organization.