Green Hat Security Advisory · GH-ADV-2026-006
CVE-2026-100404
Zulip guest access to new messages outside subscribed channels
Zulip guests could receive new messages from public channels outside their subscriptions through event queues. Fixed in 12.2, the issue was found internally and independently reported by Anthony Green of GreenHat Security.
CVE assignment and research role
Assigning CNA: GitHub. Green Hat Security's role in this record is Researcher; Green Hat did not assign this CVE ID. View the GitHub record ↗
Overview
Summary
Zulip guests could receive new messages from public channels outside their subscriptions through event queues. Fixed in 12.2, the issue was found internally and independently reported by Anthony Green of GreenHat Security.
Vulnerability Classification
Vulnerability type
Missing Authorization / Information Disclosure
Weakness
CWE-862
Affected component
Real-time message event queues
CVSS 3.1
6.5 · Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Security Impact
The flaw exposed new public-channel messages to guests who lacked channel access. Existing queues could keep delivering messages after access was removed. The published impact concerns these live events, not a demonstrated export of message history or private-channel content.
Affected Products
Zulip Server — affected versions: 12.1 and earlier.
Component: Real-time message event queues
Fixed version: 12.2 or later
Technical Details
The patch separates broad public-channel event delivery from a guest's permitted subscriptions. At delivery time, the event service excludes guests from the broad recipient path for ordinary public channels. Subscribed guests still receive their authorized events, and web-public channels retain their intended accessibility. This closes the gap left by checking access only when a queue is created.
This public record provides enough information to identify the vulnerability and its root cause without unnecessarily publishing weaponized exploit material.
Defensive lesson
Long-lived connections must respect current permissions. Test access revocation at the moment content is delivered, including queues, subscriptions, and cached recipient lists.
Research method
Lessons from the Published Fix
1. Review every route by which content reaches a user
A page view and a live event queue are separate delivery paths. Use the same guest account and synthetic channel content to check that each path enforces the intended subscription boundary.
2. Keep the connection open while permissions change
The patch's regression tests include a member becoming a guest while an existing queue remains active. Testing only newly created sessions misses the period when a connection still carries an earlier permission state.
3. Test the intended exceptions too
The regression cases preserve delivery to subscribed guests and access to web-public channels. Those positive controls help distinguish a correct authorization fix from simply disabling event delivery for every guest.
Attack Requirements
- An authenticated guest account in the affected Zulip organization.
- An event queue requesting a non-subscribed public channel, or an existing queue surviving the loss of channel access.
- New messages sent while the affected queue is active; no interaction by another victim is required by the published CVSS vector.
Remediation
Fixed version: 12.2 or later
Guidance: Upgrade self-hosted Zulip Server to 12.2 or later. Zulip's release announcement states that Zulip Cloud was already upgraded.
- In a test organization, verify that a guest cannot receive new events from an ordinary public channel they have not joined.
- Repeat the check using a queue created before unsubscription or a change from member to guest.
- Confirm subscribed guests and web-public channels continue to work as intended.
Disclosure Timeline
Security release and public credit
Zulip released 12.2 and credited its internal audit and Anthony Green's independent report. CVE IDs were still requested at that time.
CVE record published
GitHub published CVE-2026-100404, identifying CWE-862 and the 12.2 fix.
The August announcement predates CVE assignment. The current CVE record is published and names GitHub_M as the assigning CNA. A private report date is not stated in these sources; the lessons here come from the published fix, not a new lab run.
Researcher Credit
- Anthony Green [antnation] — Green Hat Security
Coordination and CVE Attribution
Zulip credits an internal audit and an independent report by Anthony Green of GreenHat Security. Zulip shipped the fix and published the GHSA; GitHub assigned the CVE. Anthony's credit is documented in the release announcement.
Green Hat Security did not reserve or assign the CVE ID.
The August announcement predates CVE assignment. The current CVE record is published and names GitHub_M as the assigning CNA. A private report date is not stated in these sources; the lessons here come from the published fix, not a new lab run.