Is CVE-2026-100404 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-100404 being exploited in the wild.

How severe is CVE-2026-100404?

Medium severity, with a CVSS score of 6.5, published 14 October 2026.

Is there a fix for CVE-2026-100404?

Yes: fixed in 12.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-100404 attacked?

It is attacked over the network.

Am I affected by CVE-2026-100404?

Check whether you run Zulip Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100404: Zulip Server information disclosure in event queue

CVE-2026-100404 · Severity: medium · CVSS 6.5 · Published 2026-10-14

Zulip Server, an open-source team chat platform, allows guest users to receive new messages from public channels they don't have access to by manipulating event queue registration parameters or exploiting a window after their channel access is revoked. An attacker can read messages from channels they should not see, exposing confidential team communications.

Technologies: Zulip Server. Vendors: Zulip.

Quick answers

Is CVE-2026-100404 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-100404 being exploited in the wild.
How severe is CVE-2026-100404?: Medium severity, with a CVSS score of 6.5, published 14 October 2026.
Which products and versions are affected?: Zulip Server through 12.1.
Is there a fix for CVE-2026-100404?: Yes: fixed in 12.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-100404 attacked?: It is attacked over the network.
Am I affected by CVE-2026-100404?: Check whether you run Zulip Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 12.2

Technical details

Guest users can receive message events for unsubscribed public channels when registering an event queue with 'all_public_streams' set to true or by including unsubscribed streams in the 'narrow' filter. The vulnerability persists if a guest is unsubscribed from a channel after the event queue is already registered. The fix filters message events to exclude guests not subscribed to the channel by checking against active guest user IDs.

Affected products

Zulip Server through 12.1

Timeline

2026-08-06: patched: Fix committed to main branch
2026-10-14: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.