Guest User Information Disclosure in Zulip Collaboration Tool

CVE-2026-100404

What is CVE-2026-100404?

Zulip, the open-source team collaboration tool, has a vulnerability that permits guest users to receive new message notifications from public channels that they are not subscribed to. This flaw emerges when a guest registers an event queue that requests messages from an unsubscribed public channel, or if the queue remains active even after the guest's permissions have been revoked. As a result, this vulnerability leads to unintended disclosure of messages in public channels to unauthorized guest users. The issue has been rectified in Zulip Server version 12.2.

References