Vulnerability · Published Oct 14, 2026 · Assigned by GitHub_M

CVE-2026-100404Zulip: Guests can read new messages in non-subscribed public channels

Medium 6.5

In plain English

A medium-severity missing authorization in zulip from zulip. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.4%top 64.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, guest users can receive new message events for public channels outside their subscriptions. A guest can trigger the issue by registering an event queue with parameters that request messages from an unsubscribed public channel, or an existing event queue can remain affected after the guest's access to the channel is removed. The flaw discloses new public-channel messages to the guest. This issue is fixed in version 12.2.

Affected products (as reported)

Vendor	Product	Versions
zulip	zulip	< 12.2

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/zulip/zulip/security/advisories/GHSA-5r8f-gq2h-fcgp x_refsource_CONFIRM
https://github.com/zulip/zulip/pull/39913 x_refsource_MISC
https://github.com/zulip/zulip/commit/98659a41cb93d4ce329ea14bb0cdfb4b147500ba x_refsource_MISC
https://github.com/zulip/zulip/commit/c03db8916456674df3c98614f6f0ef8cd024ef11 x_refsource_MISC
https://github.com/zulip/zulip/releases/tag/12.2 x_refsource_MISC