CVE-2026-40300 | Zulip up to 11.x history message_edit_history_visibility_policy access control

A vulnerability described as critical has been identified in Zulip up to 11.x. Affected by this vulnerability is the function message_edit_history_visibility_policy of the file /api/v1/messages/{id}/history. Executing a manipulation can lead to improper access controls.

This vulnerability appears as CVE-2026-40300. The attack may be performed from remote. There is no available exploit.

Upgrading the affected component is recommended.