Content of future message edits and topic metadata leaked to non-subscribers when moving messages to an inaccessible private channel

This was discovered in an internal security audit using Claude Code.

Impact

Two data leaks occur when moving messages from a public channel to a private channel. A "non-subscriber" below refers to a user who is not subscribed to the private channel, and therefore under Zulip's access model shouldn't have access to its contents.

• A non-subscriber's historical UserMessage rows (created by starring/reacting/marking-read in the public channel) survive the move, so the non-subscriber keeps receiving update_message events - leaking the content of any future edits to the affected messages, in a channel whose content should be inaccessible to them.
• A non-subscriber's UserTopic row - recording that they muted or followed the topic in the public channel - is migrated into the private target channel instead of removed. This both persists the row and pushes to that user a user_topic event carrying the private channel's stream_id and topic_name.

Root cause

Both leaks stem from access being inferred from Subscription rows, while in a public channel a user can hold a UserMessage or UserTopic row without any subscription:

• Content-edit update_message events were sent to every holder of a UserMessage row, with no access check at all - so a non-subscriber's surviving rows kept delivering edits.
• On a channel move, the set of users "losing access" (whose UserTopic row is removed rather than migrated) is derived from Subscription rows on the old channe…