CVE-2024-56136

Name of the Vulnerable Software and Affected Versions Zulip Server versions 7.0 through 9.3

Description The issue concerns an information disclosure attack where an unauthenticated user can determine if an email address is in use by a user on a Zulip server hosting multiple organizations. There are no known workarounds for this issue.

Recommendations For Zulip Server versions 7.0 through 9.3, upgrade to Zulip Server 9.4 or switch to the main branch of Zulip Server to resolve the issue. At the moment, there is no other information about additional mitigation measures.