description: In Zulip Server before 1.7.1, on a server with multiple realms, a vulnerability in the invitation system lets an authorized user of one realm on the server create a user account on any other realm.
problem types: Incorrect Authorization (CWE-863)
affected:
{
product: Zulip Server
vendor: Zulip
versions:
status: affected, version: before 1.7.1
}