Is CVE-2025-30369 actively exploited?

No active exploitation of CVE-2025-30369 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2025-30369 be exploited remotely?

Yes. CVE-2025-30369 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2025-30369?

CVE-2025-30369 has a CVSS score of 2.7 (LOW).

HOME VULNERABILITIESCVE-2025-30369

LOW

CVE-2025-30369

CWE-566Published: March 31, 2025· Updated: Jun 17, 2026

2.7

CVSS v3.1

Official Description

Zulip is an open-source team collaboration tool. The API for deleting an organization custom profile field is supposed to be restricted to organization administrators, but its handler failed to check that the field belongs to the same organization as the user. Therefore, an administrator of any organization was incorrectly allowed to delete custom profile fields belonging to a different organization. This is fixed in Zulip Server 10.1.

NVD Source

Technical Analysis

CVE-2025-30369 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires high privileges, which limits the exposure to scenarios where an attacker has already gained initial access.