A missing authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows a delegated administrator with no explicit administrative grants to… (CVE-2026-93639)

CVE-2026-93639 is a missing authorization vulnerability in Zimbra Collaboration Suite (ZCS) that permits a delegated administrator lacking explicit administrative privileges to overwrite the global Zimlet configuration via the ConfigureZimletRequest. The attacker can add a domain they control to the proxy allowlist of the default class of service. When a signed-in user in that class visits a crafted /service/proxy URL, Zimbra serves attacker-controlled HTML under its own origin, enabling JavaScript to access mailbox data and perform authenticated actions on behalf of the victim. Exploitation requires access to a delegated-administrator account and the admin SOAP service, plus victim interaction with the crafted URL. The affected versions are ZCS 10.1.16 and 10.1.20.

Successful exploitation allows an attacker with delegated-administrator access to modify global Zimlet configurations and add malicious domains to the proxy allowlist. This leads to cross-origin scripting attacks under Zimbra's origin, enabling theft of mailbox data and execution of authenticated actions as the victim user. The vulnerability has a high impact on confidentiality and integrity but does not affect availability. Exploitation requires both privileged delegated-admin access and victim user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict delegated-administrator privileges and monitor access to the admin SOAP service. Educate users to avoid opening suspicious or crafted URLs related to /service/proxy. Follow vendor updates for patches or official mitigations.