# CVE-2026-100404: Zulip Server information disclosure in event queue

Source: https://junglewise.ai/threats/cve-2026-100404-zulip-is-an-open-source-team-collaboration-tool-in-zulip-server  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-14. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-100404 · Severity: medium · CVSS 6.5 · Published 2026-10-14

Zulip Server, an open-source team chat platform, allows guest users to receive new messages from public channels they don't have access to by manipulating event queue registration parameters or exploiting a window after their channel access is revoked. An attacker can read messages from channels they should not see, exposing confidential team communications.

Technologies: [Zulip Server](https://junglewise.ai/threats/technologies/zulip-server). Vendors: [Zulip](https://junglewise.ai/threats/vendors/zulip).

## Quick answers

**Is CVE-2026-100404 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-100404 being exploited in the wild.

**How severe is CVE-2026-100404?** Medium severity, with a CVSS score of 6.5, published 14 October 2026.

**Which products and versions are affected?** Zulip Server through 12.1.

**Is there a fix for CVE-2026-100404?** Yes: fixed in 12.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-100404 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-100404?** Check whether you run Zulip Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 12.2

## Technical details

Guest users can receive message events for unsubscribed public channels when registering an event queue with 'all_public_streams' set to true or by including unsubscribed streams in the 'narrow' filter. The vulnerability persists if a guest is unsubscribed from a channel after the event queue is already registered. The fix filters message events to exclude guests not subscribed to the channel by checking against active guest user IDs.

## Affected products

- Zulip Server through 12.1

## Timeline

- 2026-08-06: patched: Fix committed to main branch
- 2026-10-14: advisory

## References

- [https://github.com/zulip/zulip/commit/98659a41cb93d4ce329ea14bb0cdfb4b147500ba](https://github.com/zulip/zulip/commit/98659a41cb93d4ce329ea14bb0cdfb4b147500ba)
- [https://github.com/zulip/zulip/commit/c03db8916456674df3c98614f6f0ef8cd024ef11](https://github.com/zulip/zulip/commit/c03db8916456674df3c98614f6f0ef8cd024ef11)

## Related threats

- [Zulip Server missing content length limit in render endpoint](https://junglewise.ai/threats/cve-2026-97701-zulip-is-an-open-source-team-collaboration-tool-in-zulip-server)
- [Zulip Server OpenID Connect email verification bypass](https://junglewise.ai/threats/cve-2026-102893-zulip-is-an-open-source-team-collaboration-tool-in-zulip-server)
- [Zulip Server improper access control in message history API](https://junglewise.ai/threats/cve-2026-40300-zulip-server-improper-access-control-in-message-history-api)