A cross-site request forgery vulnerability in the OAuth extension of Zimbra Collaboration Suite (ZCS) Network Edition allows an attacker to link an… (CVE-2026-93631)

The vulnerability in Zimbra Collaboration Suite (ZCS) Network Edition's OAuth extension arises because the OAuth callback does not properly bind the state value or authorization code to the initiating Zimbra session. Instead, it relies on the browser's current authentication cookie to select the destination mailbox. An attacker can exploit this by inducing a signed-in victim to load a specially crafted OAuth callback containing a fresh authorization code for the attacker's provider account. This results in linking the attacker's external account to the victim's mailbox, creating a persistent data source that imports attacker-controlled contacts or events. Furthermore, with bidirectional CalDAV synchronization enabled, appointments created or edited in the linked calendar can be disclosed to the attacker. The affected versions are ZCS 10.1.16 and 10.1.20.

Successful exploitation allows an attacker to link their external account to a victim's mailbox, enabling the import of attacker-controlled contacts and calendar events. This can lead to unauthorized disclosure of sensitive calendar appointment information. The vulnerability has a CVSS v3.1 score of 7.1, indicating high severity with high confidentiality impact, low integrity impact, and no availability impact.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, organizations should consider mitigating the risk by restricting OAuth provider configurations, educating users about phishing and suspicious links, and monitoring for unusual calendar or contact imports related to OAuth integrations.