Zulip Server CVE-2026-100404

Requires a valid, authenticated guest account in the target Zulip realm (PR:L); fully unauthenticated external attackers cannot exploit it. The affected object is a public but non-web-public channel the guest is not subscribed to - web-public channels are already accessible so are not the target, and private channels are unaffected. The guest triggers disclosure by registering an event queue with narrow parameters requesting an unsubscribed public channel, or by retaining an existing event queue that was created while subscribed and then keeps delivering after channel access is revoked. Limiting factors that reduce real-world risk: only NEW messages posted after the queue is active are leaked (no historical/backfill access), only guest-role accounts are affected, and all Zulip Server versions through 12.1 are vulnerable while 12.2 is fixed.

This is a genuine but moderate-severity authorization flaw (CWE-862), not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) is internally consistent with the description: exploitation is over the network via Zulip's event-queue API, requires low attacker effort, needs a valid but low-privileged guest account (PR:L), no user interaction, and yields confidentiality-only impact with no integrity or availability effect. No EPSS score, CISA KEV listing, or public exploit was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active or widespread exploitation. The patch commits and GitHub advisory (GHSA-5r8f-gq2h-fcgp) are public, which modestly lowers the barrier to building an exploit but does not constitute weaponized or in-the-wild activity. Net priority: a real tenant-isolation/data-disclosure bug that organizations relying on Zulip guest restrictions (e.g., external contractors) should patch promptly, but the authenticated-guest prerequisite and confidentiality-only, new-message-only scope keep it below critical urgency. Note the input tag 'Authentication Bypass' conflicts with CWE-862 and the PR:L vector - the guest is authenticated and the flaw is a missing authorization check, not an authentication bypass.

An external user who has been granted only a guest account in a Zulip organization registers an event queue with a narrow targeting a public (non-web-public) channel they are not subscribed to, or keeps a previously registered queue alive after an admin removes their channel access. New messages posted to that channel are then streamed to the guest, exposing internal discussions they should not see. No public exploit code was identified, but the fix commits publicly document the vulnerable code path.