Main
Vulnerability Database
Exploits
ID:12645 - Exploit for Improper access control in Zulip Server - CVE-2026-40300
ID:12645 - Exploit for Improper access control in Zulip Server - CVE-2026-40300
Published: April 27, 2026
Vulnerability identifier: #VU127959
Vulnerability risk: Medium
CVE-ID: CVE-2026-40300
CWE-ID: CWE-284
Exploitation vector: Remote access
Vulnerable software:
Zulip Server
Zulip Server
Link to public exploit:
Vulnerability description
The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions in "moves only" policy within /api/v1/messages/{id}/history. A remote user can bypass implemented security restrictions and gain unauthorized access to message edit history.
Remediation
Install updates from vendor's website.