CVE-2026-100404
MediumCVSS 6.5Summary
Zulip Server versions through 12.1 allow guest users to receive new message events for public channels outside their subscriptions. A guest can register an event queue requesting messages from an unsubscribed public channel, or an existing queue can remain affected after access is removed, disclosing new public-channel messages to the guest.
Risk Assessment
The vulnerability breaches confidentiality of public channel content, exposing it to users without proper authorization and potentially leaking internal organizational information.
Recommendation
Update Zulip Server to version 12.2 or later.
Other vulnerabilities in Zulip Server
See all- CVE-2017-0910High
In Zulip Server before 1.7.1, a vulnerability in the invitation system allows an authorized user from one realm on the server to create a user account in any other realm.
- CVE-2026-102893Critical
Zulip Server through 12.1 has a vulnerability in GenericOpenIdConnectBackend that does not reject an explicitly false email_verified claim, allowing login to an existing account if a misconfigured trusted identity provider returns an email address not controlled by the user.
- CVE-2023-33186High
Zulip, a team collaboration tool, has a cross-site scripting (XSS) vulnerability in tooltips on the message feed. An attacker can craft a malicious topic for a message that, when hovered over by a victim, executes JavaScript code controlled by the attacker.
Original NVD description (English source)
Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, guest users can receive new message events for public channels outside their subscriptions. A guest can trigger the issue by registering an event queue with parameters that request messages from an unsubscribed public channel, or an existing event queue can remain affected after the guest's access to the channel is removed. The flaw discloses new public-channel messages to the guest. This issue is fixed in version 12.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS