PT-2026-40100 · Zulip · Zulip

CVE-2026-40300 · Published 2026-05-12 · Updated 2026-05-12

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zulip versions prior to 12.0

Description When the message edit history visibility policy is set to "moves", the '/api/v1/messages/{id}/history' endpoint continues to return historical content values. This allows users with low privileges to recover text that was previously edited and removed from messages sent by other users.

Recommendations Update to version 12.0.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2026-40300

GHSA-JP8F-MVV6-89CR

Affected Products

Zulip

References · 4

• 🔥 https://github.com/zulip/zulip/security/advisories/GHSA-jp8f-mvv6-89cr · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40300.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-40300 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40300 · Security Note