Is CVE-2026-40300 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-40300 being exploited in the wild.

How severe is CVE-2026-40300?

Medium severity, with a CVSS score of 6.5, published 12 May 2026.

Which products and versions are affected?

Zulip Zulip Server Prior to 12.0.

Is there a fix for CVE-2026-40300?

A patch was published on 12.0: Vulnerability fixed in Zulip Server version 12.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-40300 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-40300?

Check whether you run Zulip Server. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40300: Zulip Server improper access control in message history API

CVE-2026-40300 · Severity: medium · CVSS 6.5 · Published 2026-05-12

Zulip is an open-source team collaboration platform. A security flaw allows users to view the original content of edited messages even when the organization has configured a policy to hide message history. This could lead to the exposure of sensitive information that a user intentionally removed or corrected, such as passwords, private data, or confidential internal notes.

Technologies: Zulip Server. Vendors: Zulip.

Quick answers

Is CVE-2026-40300 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-40300 being exploited in the wild.
How severe is CVE-2026-40300?: Medium severity, with a CVSS score of 6.5, published 12 May 2026.
Which products and versions are affected?: Zulip Zulip Server Prior to 12.0.
Is there a fix for CVE-2026-40300?: A patch was published on 12.0: Vulnerability fixed in Zulip Server version 12.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-40300 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-40300?: Check whether you run Zulip Server. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An improper access control vulnerability exists in Zulip Server's message history API. When the 'message_edit_history_visibility_policy' is set to 'moves', the system is intended to only expose metadata regarding message moves (topic changes) rather than content edits. However, the API endpoint '/api/v1/messages/{id}/history' fails to properly filter the 'content', 'rendered_content', and 'initial_message_history' fields. A remote attacker with low privileges (authenticated user or guest with access to the stream) can bypass the UI-level restrictions by calling the API directly to recover historical message text. The root cause is located in 'zerver/lib/message.py::visible_edit_history_for_message', which fails to strip all content-bearing fields. This issue is fixed in version 12.0.

Affected products

Zulip Zulip Server Prior to 12.0

Timeline

2026-04-27: advisory: GitHub security advisory published by Zulip maintainers
2026-05-12: disclosed: CVE-2026-40300 published
12.0: patched: Vulnerability fixed in Zulip Server version 12.0

References

https://github.com/zulip/zulip/security/advisories/GHSA-jp8f-mvv6-89cr

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.