Is there a patch available for CVE-2026-40300?

Yes, a patch is available for CVE-2026-40300. Update the affected software to the latest version immediately.

Zulip CVE-2026-40300

Q: What is the CVSS score of CVE-2026-40300?

CVE-2026-40300 has a CVSS 4.0 base score of 6.0 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

Q: Which versions of Zulip are affected by CVE-2026-40300?

Zulip's message history API endpoint fails to enforce the `message_edit_history_visibility_policy` when set to 'moves', exposing full prior message text to low-privilege authenticated users via…. A patch is available.

EUVD-2026-29537 MEDIUM

Improper Access Control (CWE-284)

2026-05-12 GitHub_M

Authentication Bypass Zulip

6.0

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.0 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.3 MEDIUM

AC:H reflects the prerequisite non-default configuration; PR:L for required authenticated account; C:H for disclosed message text; no integrity or availability impact.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 22:26 vuln.today

Patch available

May 12, 2026 - 18:03 EUVD

CVSS changed

May 12, 2026 - 17:22 NVD

6.0 (MEDIUM)

CVE Published

May 12, 2026 - 16:33 nvd

MEDIUM 6.0

CVE Published

May 12, 2026 - 16:33 nvd

UNKNOWN (no severity yet)

DescriptionGitHub Advisory

Zulip is an open-source team collaboration tool. Prior to 12.0, With message_edit_history_visibility_policy set to "moves", /api/v1/messages/{id}/history still returns historical content values, allowing low-privilege users to recover text that was edited away from other users' messages. This vulnerability is fixed in 12.0.

AnalysisAI

Zulip's message history API endpoint fails to enforce the message_edit_history_visibility_policy when set to 'moves', exposing full prior message text to low-privilege authenticated users via /api/v1/messages/{id}/history. Administrators who deliberately configured this policy to limit edit history visibility to move-events only will find that the underlying content is still recoverable through the API, bypassing the intended access control. No public exploit has been identified and EPSS is 0.04% (12th percentile), but the confidentiality impact is rated High in the CVSS 4.0 assessment for instances operating under this configuration.

Technical ContextAI

Zulip (CPE: cpe:2.3:a:zulip:zulip:*:*:*:*:*:*:*:*) is an open-source team collaboration platform offering threaded messaging. The message_edit_history_visibility_policy setting provides administrators a privacy control over what edit metadata is surfaced to users; the 'moves' value is intended to restrict visibility to topic or stream relocations only, hiding the textual delta of edits. CWE-284 (Improper Access Control) is the root cause: the REST endpoint /api/v1/messages/{id}/history does not consult the configured policy before returning historical content values, rendering the access control setting inoperative for this code path. The CVSS 4.0 vector's AT:P (Attack Requirements: Present) corroborates that exploitation is gated on a specific deployment precondition - the 'moves' policy being active.

RemediationAI

The primary fix is upgrading to Zulip 12.0, which resolves the improper access control in the message history endpoint per the vendor advisory at https://github.com/zulip/zulip/security/advisories/GHSA-jp8f-mvv6-89cr. As a compensating control prior to patching, administrators can change message_edit_history_visibility_policy away from 'moves' to a less restrictive setting (such as 'everyone' or 'admins-only'), accepting the trade-off that the intended privacy restriction is removed entirely. Restricting API access to /api/v1/messages/{id}/history at the network or WAF layer is another option, but this will break legitimate Zulip client functionality that uses message history to render edit indicators. The cleanest and only complete remediation is the 12.0 upgrade.