Zulip Server Custom Profile Field Deletion Vulnerability Allowing Cross-Organization Field Removal

A vulnerability exists in Zulip Server versions 1.6.0 through 10.0, allowing organization administrators to delete custom profile fields from other organizations. The issue arises because the API handling the deletion does not verify that the field belongs to the same organization as the user. This flaw enables administrators to inadvertently remove fields from different organizations.

Impact

Exploitation of this vulnerability allows for unauthorized deletion of custom profile fields across organizations.

Remediation

Users can upgrade to Zulip Server 10.1 to address this vulnerability. For servers hosting only one organization where new organizations cannot be created, this vulnerability is not applicable.