CVE-2026-100404

Awaiting Analysis Awaiting Analysis - Queue

Guest Users Access to Unsubscribed Public Channel Messages in Zulip Server

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, guest users can receive new message events for public channels outside their subscriptions. A guest can trigger the issue by registering an event queue with parameters that request messages from an unsubscribed public channel, or an existing event queue can remain affected after the guest's access to the channel is removed. The flaw discloses new public-channel messages to the guest. This issue is fixed in version 12.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-100404

EUVD

EUVD-2026-101288

Affected Vendors & Products

Vendor	Product	Version / Range
zulip	zulip	< 12.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability in Zulip Server versions through 12.1 allows guest users to receive new message events for public channels they are not subscribed to. Guests can trigger this by registering an event queue requesting messages from unsubscribed channels or by retaining access after unsubscribing. The flaw exposes new public-channel messages to unauthorized guests.

Detection Guidance

Detecting this vulnerability requires checking if guest users are receiving events for unsubscribed public channels. Review event queue registrations for parameters like 'all_public_streams' set to True or narrow filters including unsubscribed streams. Check Zulip server logs for unusual event queue activity or message events sent to guest users outside their subscriptions.

Impact Analysis

Unauthorized guests could read messages in public channels they should not access, compromising data confidentiality. The attack requires network access and low privileges but no user interaction. It does not affect data integrity or system availability.

Compliance Impact

This vulnerability could violate data protection regulations like GDPR and HIPAA by exposing sensitive information to unauthorized users. Organizations using affected Zulip versions may face compliance risks due to unauthorized data access.

Mitigation Strategies

Upgrade Zulip Server to version 12.2 or later to address CVE-2026-100404. This version includes the necessary security fixes to prevent guest users from receiving messages from unsubscribed public channels.

Hi! I’m here to help you understand CVE-2026-100404. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70