CVE-2022-24751

Name of the Vulnerable Software and Affected Versions Zulip versions 4.0 through 4.10

Description Zulip is an open source group chat application that is vulnerable to a race condition during account deactivation. This issue may allow continued access by a deactivated user in rare cases if there is simultaneous access by the user being deactivated.

Recommendations For Zulip versions 4.0 through 4.10, upgrade to version 4.11 on the 4.x branch or version 5.0-rc1 on the 5.x branch to resolve the issue. Upgrading to a fixed version will deactivate any cached sessions that may have been leaked through this bug.