Post

GitHub Security Lab

@securitylab.github.com

Hidden feature in Signal? Not for attackers! An attacker with no admin privileges can delete any message in a group!

2/4/26, 6:12 pm0 reposts1 like

GitHub Security Lab

@securitylab.github.com

securitylab.github.com/advisories/G...

securitylab.github.comGHSL-2026-095: Unauthorized message deletion in Signal for iOSSignal for iOS v8.2 is affected by a vulnerability where an attacker can exploit an improper authorization check within the Admin Delete message handler, leading to unauthorized message deletion.

GitHub Security Lab

@securitylab.github.com

securitylab.github.com/advisories/G...

securitylab.github.comGHSL-2026-082: Unauthorized message deletion in Signal for AndroidSignal for Android versions >= v8.1.0 and < v8.3.0 are affected by a vulnerability where an attacker can exploit improperly validated group context within the Admin Delete message handler, leading to ...