# CVE-2026-40300: Zulip Server improper access control in message history API

Source: https://junglewise.ai/threats/cve-2026-40300-zulip-server-improper-access-control-in-message-history-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-12. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2026-40300 · Severity: medium · CVSS 6.5 · Published 2026-05-12

Zulip is an open-source team collaboration platform. A security flaw allows users to view the original content of edited messages even when the organization has configured a policy to hide message history. This could lead to the exposure of sensitive information that a user intentionally removed or corrected, such as passwords, private data, or confidential internal notes.

Technologies: [Zulip Server](https://junglewise.ai/threats/technologies/zulip-server). Vendors: [Zulip](https://junglewise.ai/threats/vendors/zulip).

## Quick answers

**Is CVE-2026-40300 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40300 being exploited in the wild.

**How severe is CVE-2026-40300?** Medium severity, with a CVSS score of 6.5, published 12 May 2026.

**Which products and versions are affected?** Zulip Zulip Server Prior to 12.0.

**Is there a fix for CVE-2026-40300?** A patch was published on 12.0: Vulnerability fixed in Zulip Server version 12.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-40300 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-40300?** Check whether you run Zulip Server. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An improper access control vulnerability exists in Zulip Server's message history API. When the 'message_edit_history_visibility_policy' is set to 'moves', the system is intended to only expose metadata regarding message moves (topic changes) rather than content edits. However, the API endpoint '/api/v1/messages/{id}/history' fails to properly filter the 'content', 'rendered_content', and 'initial_message_history' fields. A remote attacker with low privileges (authenticated user or guest with access to the stream) can bypass the UI-level restrictions by calling the API directly to recover historical message text. The root cause is located in 'zerver/lib/message.py::visible_edit_history_for_message', which fails to strip all content-bearing fields. This issue is fixed in version 12.0.

## Affected products

- Zulip Zulip Server Prior to 12.0

## Timeline

- 2026-04-27: advisory: GitHub security advisory published by Zulip maintainers
- 2026-05-12: disclosed: CVE-2026-40300 published
- 12.0: patched: Vulnerability fixed in Zulip Server version 12.0

## References

- [https://github.com/zulip/zulip/security/advisories/GHSA-jp8f-mvv6-89cr](https://github.com/zulip/zulip/security/advisories/GHSA-jp8f-mvv6-89cr)

## Related threats

- [Zulip Server missing content length limit in render endpoint](https://junglewise.ai/threats/cve-2026-97701-zulip-is-an-open-source-team-collaboration-tool-in-zulip-server)
- [Zulip Server OpenID Connect email verification bypass](https://junglewise.ai/threats/cve-2026-102893-zulip-is-an-open-source-team-collaboration-tool-in-zulip-server)
- [Zulip Server information disclosure in event queue](https://junglewise.ai/threats/cve-2026-100404-zulip-is-an-open-source-team-collaboration-tool-in-zulip-server)