CVE-2026-40300: Zulip: Message edit history visible in "moves only" policy through /api/v1/messages/{id}/history
Zulip is an open-source team collaboration tool. Prior to 12.0, With messageedithistoryvisibilitypolicy set to "moves", /api/v1/messages/{id}/history still returns historical content values, allowing low-privilege users to recover text that was edited away from other users' messages. This vulnerability is fixed in 12.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40300?
CVE-2026-40300 is considered a high severity vulnerability due to its potential exposure of sensitive message edit history.
How do I fix CVE-2026-40300?
To address CVE-2026-40300, upgrade Zulip to version 12.0 or later where the issue has been resolved.
What specific component of Zulip does CVE-2026-40300 affect?
CVE-2026-40300 affects the message edit history visibility policy in Zulip versions prior to 12.0.
What data is exposed by CVE-2026-40300?
CVE-2026-40300 exposes historical content values of messages even under a restricted edit history visibility policy.
Who is impacted by CVE-2026-40300?
Users of Zulip versions prior to 12.0 that utilize the 'moves only' message edit history visibility policy are impacted by CVE-2026-40300.