Login Request a demo
Medium severity · published Oct 14, 2026
CVE-2026-100404
Zulip: Guests can read new messages in non-subscribed public channels
6.5
CVSS
0.4%
EPSS
No
On KEV
Description
Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, guest users can receive new message events for public channels outside their subscriptions. A guest can trigger the issue by registering an event queue with parameters that request messages from an unsubscribed public channel, or an existing event queue can remain affected after the guest's access to the channel is removed. The flaw discloses new public-channel messages to the guest. This issue is fixed in version 12.2.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ZU
zulip · zulip
< 12.2 · source: vendor
Affected product
ZU
zulip
zulip
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-100404
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-100404
x_refsource_CONFIRM
https://github.com/zulip/zulip/security/advisories/GHSA-5r8f-gq2h-fcgp
x_refsource_MISC
https://github.com/zulip/zulip/pull/39913
x_refsource_MISC
https://github.com/zulip/zulip/commit/98659a41cb93d4ce329ea14bb0cdfb4b147500ba
x_refsource_MISC
https://github.com/zulip/zulip/commit/c03db8916456674df3c98614f6f0ef8cd024ef11
x_refsource_MISC
https://github.com/zulip/zulip/releases/tag/12.2
More from zulip
9.8
CVE-2022-21706
Multi-use invitations can grant access to other organizations in Zulip
9.8
CVE-2021-43799
RabbitMQ exposes ports with weak default secrets in Zulip Server
9.1
CVE-2026-102893
Zulip: OpenID Connect authentication ignores the email_verified claim
8.8
CVE-2022-31168
Zulip Server insufficient authorization for changing bot roles
8.8
CVE-2021-3967
Improper Access Control in zulip/zulip