Zulip Server Organization Export Deletion Vulnerability

A vulnerability in Zulip Server's export deletion API allowed organization administrators to delete exports from other organizations. The issue arose because the API did not properly verify that the export belonged to the same organization as the user. This flaw was present in Zulip Server 10.0 and was fixed in version 10.1.

Impact

Exploitation of this vulnerability could lead to unauthorized deletion of organization export data.

Reproduction

To reproduce this vulnerability, an administrator of one organization can use the export deletion API to remove an export from a different organization, bypassing the intended restrictions.

Remediation

Users can upgrade to Zulip Server 10.1 to address this vulnerability.