Executive brief
Zulip is an open-source team collaboration platform. A security flaw allows users to view the original content of edited messages even when the organization has configured a policy to hide message history. This could lead to the exposure of sensitive information that a user intentionally removed or corrected, such as passwords, private data, or confidential internal notes.
Technical details
An improper access control vulnerability exists in Zulip Server's message history API. When the 'message_edit_history_visibility_policy' is set to 'moves', the system is intended to only expose metadata regarding message moves (topic changes) rather than content edits. However, the API endpoint '/api/v1/messages/{id}/history' fails to properly filter the 'content', 'rendered_content', and 'initial_message_history' fields. A remote attacker with low privileges (authenticated user or guest with access to the stream) can bypass the UI-level restrictions by calling the API directly to recover historical message text. The root cause is located in 'zerver/lib/message.py::visible_edit_history_for_message', which fails to strip all content-bearing fields. This issue is fixed in version 12.0.
Affected products
- Zulip Zulip Server Prior to 12.0
Timeline
- 2026-04-27: advisory: GitHub security advisory published by Zulip maintainers
- 2026-05-12: disclosed: CVE-2026-40300 published
- 12.0: patched: Vulnerability fixed in Zulip Server version 12.0