In Zulip Server versions prior to 12.2, guest users can register an event queue that requests new message events from public channels they are not subscribed to. When a guest does so, or when an existing event queue remains after the guest is removed from the channel, the system will still dispatch new messages to the guest. This results in the guest being able to read the contents of public‑channel messages that they should not see, leading to an unauthorized information disclosure, classified as a missing authorization weakness (CWE‑862). The flaw allows an attacker to capture new messages in real time, potentially leaking sensitive discussion content.

Zulip Server from any version up to and including 12.1 is affected. The vulnerability was addressed in release 12.2. The affected product is the Zulip collaboration platform. The flaw is present in the event‑queue handling logic that does not verify a guest’s subscription status when filtering public‑channel events.

The CVSS v3.1 score is 6.5, indicating a moderate severity. EPSS score is 0.00415 (less than 1%), and the vulnerability is not listed in the CISA KEV catalog. The attack requires the presence of a guest account or the ability to create one and to register an event queue by providing the channel identifier. Because the weakness is a server‑side authorization flaw rather than an exploit that requires privileged code execution, the exploitation is relatively straightforward for an attacker who can gain guest access. The impact is limited to confidentiality – an attacker learns new messages from channels they are not subscribed to. Although current exploit evidence is not reported, the moderate CVSS and requirement for only a guest account elevate the risk for organizations using Zulip with guest access enabled.