CVE-2025-47930

Name of the Vulnerable Software and Affected Versions: Zulip versions 10.0 through 10.2

Description: The issue concerns the "Who can create public channels" access control mechanism in Zulip, which can be circumvented by creating a private or web-public channel and then changing the channel privacy to public. A similar technique can be used to create private channels without permission, though this requires either using the API or modifying the HTML.

Recommendations: For versions 10.0 through 10.2, update to version 10.3 to resolve the issue.