CVE-2026-100404: Zulip: Guests can read new messages in non-subscribed public channels
Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, guest users can receive new message events for public channels outside their subscriptions. A guest can trigger the issue by registering an event queue with parameters that request messages from an unsubscribed public channel, or an existing event queue can remain affected after the guest's access to the channel is removed. The flaw discloses new public-channel messages to the guest. This issue is fixed in version 12.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Zulip Serverto a version that resolves this vulnerability.Fixed in 12.2
Event History
Frequently Asked Questions
Which deployments are affected?
Zulip Server versions through 12.1 are affected. The issue is fixed in version 12.2.
What does an attacker need to exploit this issue?
The attacker needs a guest user account. The guest can register an event queue requesting messages from a public channel to which they are not subscribed.
Can removing a guest's channel access fully stop exposure?
Not necessarily. An existing event queue can remain affected after the guest's access to the channel has been removed, allowing new messages to continue being disclosed through that queue.
What information can be exposed?
The flaw discloses new messages posted to public channels outside the guest user's subscriptions. The provided information does not indicate exposure of message integrity or service availability.