Zulip Zulip Server vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Zulip Zulip Server: 2 record(s), with affected versions and fixes.
cpe:2.3:a:zulip:zulip_server

CVE-2026-40300 Medium · 6.5 CWE-284 May 12, 2026

Zulip: Message edit history visible in "moves only" policy through /api/v1/messages/{id}/history

Zulip is an open-source team collaboration tool. Prior to 12.0, With message_edit_history_visibility_policy set to "moves", /api/v1/messages/{id}/history still returns historical content values, allowing low-privilege users to recover text that was edited away from other users' messages. This vulnerability is fixed in 12.0.

CVE-2026-24050 Medium · 5.4 CWE-79 Feb 6, 2026

Zulip affected by Stored XSS in user profile modal

Zulip is an open-source team collaboration tool. From 5.0 to before 11.5, some administrative actions on the user profile were susceptible to stored XSS in group names or channel names. Exploiting these vulnerabilities required the user explicitly interacting with the problematic object. This vulnerability is fixed in 11.5.