Read the docs
TI-2026-74168 Aliases CVE-2026-100404

Zulip guests can read new messages in unsubscribed public channels

Priority LOW 29CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

Zulip Server versions through 12.1 let guest users receive new message events for public channels they are not subscribed to. The flaw is missing authorization (CWE-862). A guest can register an event queue requesting messages from an unsubscribed public channel, or an existing queue can keep delivering messages after the guest's access is removed. An authenticated guest with network access can read new messages in those public channels.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, guest users can receive new message events for public channels outside their subscriptions. A guest can trigger the issue by registering an event queue with parameters that request messages from an unsubscribed public channel, or an existing event queue can remain affected after the guest's access to the channel is removed. The flaw discloses new public-channel messages to the guest. This issue is fixed in version 12.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00415 36th percentileScored 2026-11-07
Fix Fixed zulip (zulip): 12.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
zulipzulipbefore 12.212.2Patch availableCNA
  • zulip Vendorzulip Affected before 12.2 Fixed in 12.2 Patch available CNA

Remediation

Upgrade Zulip Server to version 12.2, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA zulip (zulip) Fixed in 12.2

Timeline

  1. 2026-10-14 Threatist record created from CVE-2026-100404
  2. 2026-10-16 Priority changed: MEDIUM → LOW
  3. 2026-10-29 CISA SSVC decision points changed

References

Other 5

  • TI-2024-37129 /api/v1/jwt/fetch_api_key endpoint can leak if an email address has an account in Zulip server CVSS 4.0MEDIUM 6.9
  • TI-2026-20810 Zulip: Anonymous File Access After Disabling Spectator Access CVSS 3.1MEDIUM 5.3
  • TI-2026-21062 Zulip: Path Traversal in Import CVSS 3.1MEDIUM 6.1
  • TI-2021-19605 RabbitMQ exposes ports with weak default secrets in Zulip Server CVSS 3.1CRITICAL 9.8
  • TI-2022-06082 Multi-use invitations can grant access to other organizations in Zulip CVSS 3.1CRITICAL 9.8
  • TI-2023-15953 Users who can send invitations can erroneously add users to streams during invitation in Zulip CVSS 3.1LOW 3.1
See all 68 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences