An authorization bypass vulnerability in Zulip allows authenticated organization members to unauthorizedly modify payment methods, potentially leading to financial disruption.

This is an incorrect authorization flaw (CWE-863) where the API endpoint for card update sessions lacks proper billing-specific capability checks. The vulnerability is exploitable by any authenticated organization member.

Successful exploitation allows a malicious or compromised user to change the payment method associated with an organization. This could result in unauthorized charges, financial fraud, or the disruption of service if the billing mechanism is tampered with. With a CVSS score of 7.1, the vulnerability represents a significant risk to organizational integrity and financial operations.

Immediate Action: This vulnerability exclusively affected the Zulip Cloud payment processing system and has been patched by the vendor. No action is required for self-hosted deployments.

Proactive Monitoring: Audit organizational payment logs and review recent changes to billing configurations for any unauthorized modifications.

Compensating Controls: Ensure that access to organization billing settings is restricted to authorized financial administrators only, and consider implementing multi-factor authentication for all user accounts to minimize the risk of compromised credentials.

Public Exploit Available: Unknown.

While self-hosted instances are not impacted by this flaw, organizations utilizing the Zulip Cloud service should verify that their payment methods remain correctly configured. The inherent risk of unauthorized billing changes makes it essential to maintain strict control over user privileges and monitor billing-related alerts.