The vulnerability allows users with only organization member privileges to access an API endpoint that initiates a card update session. When a Stripe Checkout session is completed, a webhook updates the organization’s default payment method without enforcing billing‑specific authorization. Because the access control is bypassed, a regular member can change the default card on the organization’s account. This creates a financial risk by enabling unauthorized changes to billing information and is categorized as CWE‑863, an authorization bypass weakness.

The affected product is Zulip, an open‑source team collaboration tool. Versions deployed before the commit identified by bf28c82dc in the Zulip repository are vulnerable. Self‑hosted installations are no longer affected after this commit, and no additional patch is required for those deployments.

The CVSS score of 7.1 indicates a high severity, but the EPSS score of less than 1% suggests a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. An attacker would need legitimate organization membership and access to the API; the attack vector is internal or through legitimate user credentials, making the exploitation likely if credentials are compromised or reused. Monitoring account changes and restricting API permissions are advisable until the patch is deployed.