CVE-2026-100404 json
Zulip: Guests can read new messages in non-subscribed public channels
published 2026-10-14 25 d ago modified 2026-10-29 10 d ago also EUVD-2026-101288
- cvss
- 6.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 36%
- public exploits
- 0
- none known
Summary
Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, guest users can receive new message events for public channels outside their subscriptions. A guest can trigger the issue by registering an event queue with parameters that request messages from an unsubscribed public channel, or an existing event queue can remain affected after the guest's access to the channel is removed. The flaw discloses new public-channel messages to the guest. This issue is fixed in version 12.2.
Patch / fix
- zulip zulip 12.2
- zulip zulip_server 12.2
- github.com/zulip/zulip@98659a4 commit
- github.com/zulip/zulip@c03db89 commit
- github.com/zulip/zulip#39913 pull request
- github.com/zulip/zulip/releases/tag/12.2 release
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 10 d ago
Exploit prediction
0.41% chance of exploitation in the next 30 days, higher than 36% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Affected products
- zulip zulip
Classification
- Weakness
-
- CWE-862 Missing Authorization
References
Sources
- CVE List CVE-2026-100404
- NVD CVE-2026-100404
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.