📄 Description (English)
Zulip is an open-source team collaboration tool. Prior to 12.0, With message_edit_history_visibility_policy set to "moves", /api/v1/messages/{id}/history still returns historical content values, allowing low-privilege users to recover text that was edited away from other users' messages. This vulnerability is fixed in 12.0.
🤖 AI Executive Summary
Zulip Server versions prior to 12.0 contain an improper access control vulnerability (CVE-2026-40300) that allows low-privilege users to recover edited message content through the /api/v1/messages/{id}/history endpoint, bypassing the message_edit_history_visibility_policy setting. With a CVSS score of 6.5 and publicly available exploits, this poses a moderate risk to organizations using Zulip for sensitive communications. The vulnerability affects confidentiality of edited messages and requires immediate patching or compensating controls.
📄 Description (Arabic)
🤖 AI Intelligence Analysis Analyzed: May 13, 2026 22:42
🇸🇦 Saudi Arabia Impact Assessment
Saudi organizations using Zulip for internal communications—particularly in government agencies (NCA, CITC), banking sector (SAMA-regulated institutions), healthcare organizations, and energy companies—face risks of unauthorized disclosure of edited messages containing sensitive information. The vulnerability is particularly concerning for organizations handling classified communications or confidential business discussions. Government entities and financial institutions are at highest risk due to regulatory requirements around communication audit trails and data protection.
🏢 Affected Saudi Sectors
Government (NCA, CITC, Ministry communications)
Banking and Financial Services (SAMA-regulated)
Healthcare
Energy (ARAMCO, utilities)
Telecommunications
Education
Large enterprises with internal collaboration needs
🎯 MITRE ATT&CK Techniques
⚖️ Saudi Risk Score (AI)
6.8
/ 10.0
🔧 Remediation Steps (English)
IMMEDIATE ACTIONS:
1. Upgrade Zulip Server to version 12.0 or later immediately
2. If immediate upgrade is not possible, implement the following compensating controls:
- Restrict API access to /api/v1/messages/{id}/history endpoint using reverse proxy/WAF rules
- Limit message history API access to administrative accounts only
- Monitor and log all API calls to the history endpoint
3. Review audit logs for unauthorized access to message history endpoints
4. Notify users that edited message content may have been exposed
PATCHING GUIDANCE:
- Download Zulip Server 12.0+ from official repository
- Test in staging environment before production deployment
- Plan maintenance window for upgrade (typically 30-60 minutes)
- Backup database before upgrade
DETECTION RULES:
- Alert on repeated /api/v1/messages/{id}/history API calls from non-admin accounts
- Monitor for API calls with message IDs from messages edited within last 30 days
- Track failed authentication attempts to history endpoint
- Log all successful history endpoint queries with user context
🔧 خطوات المعالجة (العربية)
الإجراءات الفورية:
1. ترقية خادم Zulip إلى الإصدار 12.0 أو أحدث فورًا
2. إذا لم يكن الترقية الفورية ممكنة، طبق الضوابط التعويضية التالية:
- قيد الوصول إلى نقطة نهاية /api/v1/messages/{id}/history باستخدام قواعد WAF/Reverse Proxy
- حدد وصول API لسجل الرسائل للحسابات الإدارية فقط
- راقب وسجل جميع استدعاءات API لنقطة النهاية
3. راجع سجلات التدقيق للوصول غير المصرح به إلى نقاط نهاية سجل الرسائل
4. أخطر المستخدمين بأن محتوى الرسائل المعدلة قد يكون قد تم الكشف عنه
إرشادات التصحيح:
- قم بتنزيل Zulip Server 12.0+ من المستودع الرسمي
- اختبر في بيئة التطوير قبل نشر الإنتاج
- خطط نافذة صيانة للترقية (عادة 30-60 دقيقة)
- قم بعمل نسخة احتياطية من قاعدة البيانات قبل الترقية
قواعد الكشف:
- تنبيه على استدعاءات متكررة لـ /api/v1/messages/{id}/history من حسابات غير إدارية
- مراقبة استدعاءات API برسائل معدلة خلال آخر 30 يومًا
- تتبع محاولات المصادقة الفاشلة لنقطة النهاية
- تسجيل جميع استعلامات نقطة النهاية الناجحة مع سياق المستخدم
📋 Regulatory Compliance Mapping
🟢 NCA ECC 2024
ECC 2024 A.6.1.1 - Information access control
ECC 2024 A.8.2.1 - User access management
ECC 2024 A.8.2.3 - Management of privileged access rights
ECC 2024 A.12.4.1 - Event logging
🔵 SAMA CSF
SAMA CSF ID.AC-1 - Access Control Policy
SAMA CSF PR.AC-1 - Processes and procedures for access management
SAMA CSF DE.AE-1 - Audit and accountability events
🟡 ISO 27001:2022
ISO 27001:2022 A.5.3 - Segregation of duties
ISO 27001:2022 A.8.2.1 - User registration and access provisioning
ISO 27001:2022 A.8.2.3 - Management of privileged access rights
ISO 27001:2022 A.8.2.4 - Access rights review
ISO 27001:2022 A.8.3.2 - Restriction of access to information
📦 Affected Products / CPE 1 entries
zulip:zulip_server:10.0