CVE-2026-100404

Name of the Vulnerable Software and Affected Versions Zulip Server versions prior to 12.2

Description Guest users can receive new message events for public channels they have not subscribed to. This occurs when a guest registers an event queue with parameters requesting messages from an unsubscribed public channel, or if an existing event queue remains active after the guest's access to the channel is revoked. This flaw results in the disclosure of new public-channel messages to the guest.

Recommendations Update Zulip Server to version 12.2.