Vulnerabilidades do Zulip Zulip Server

🔔 Criar alerta RSS Verificador de versão

CVEs publicadas que afetam Zulip Zulip Server: 2 registro(s), com versões afetadas e correções.
cpe:2.3:a:zulip:zulip_server

CVE-2026-40300 Média · 6.5 CWE-284 12/05/2026

Zulip: Message edit history visible in "moves only" policy through /api/v1/messages/{id}/history

Zulip is an open-source team collaboration tool. Prior to 12.0, With message_edit_history_visibility_policy set to "moves", /api/v1/messages/{id}/history still returns historical content values, allowing low-privilege users to recover text that was edited away from other users' messages. This vulnerability is fixed in 12.0.

CVE-2026-24050 Média · 5.4 CWE-79 06/02/2026

Zulip affected by Stored XSS in user profile modal

Zulip is an open-source team collaboration tool. From 5.0 to before 11.5, some administrative actions on the user profile were susceptible to stored XSS in group names or channel names. Exploiting these vulnerabilities required the user explicitly interacting with the problematic object. This vulnerability is fixed in 11.5.