Zulip is an open-source team collaboration tool.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. May 12, 2026 · NIST NVD

   Detected

   Zulip is an open-source team collaboration tool. Prior to 12.0, With message_edit_history_visibility_policy set to "moves", /api/v1/messages/{id}/history still returns historical content values, allowing low-privilege users to recover text that was edited away from other users' messages. This vulnerability is fixed in 12.0.

2. Jun 17, 2026 · NIST NVD

   Updated

   Zulip is an open-source team collaboration tool. Prior to 12.0, With message_edit_history_visibility_policy set to "moves", /api/v1/messages/{id}/history still returns historical content values, allowing low-privilege users to recover text that was edited away from other users' messages. This vulnerability is fixed in 12.0.

Affected

• cpe zulip/zulip server10.0

Sources

• CVE.orgVulnerability recordCVE-2026-40300

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-40300

  Zulip is an open-source team collaboration tool. Prior to 12.0, With message_edit_history_visibility_policy set to "moves", /api/v1/messages/{id}/history still returns historical content values, allowing low-privilege users to recover text that was edited away from other users' m

  nvd.nist.gov

References

• Exploit · github.com