A reflected cross-site scripting vulnerability in the Classic Web Client of Zimbra Collaboration Suite (ZCS) allows an attacker to inject JavaScript… (CVE-2026-10632)

CVE-2026-10632 is a reflected cross-site scripting vulnerability in the Classic Web Client of Zimbra Collaboration Suite (ZCS) 10.1.16. The vulnerability arises because the document editor inserts package names into script attributes without proper HTML encoding, allowing injection of malicious JavaScript through the packages parameter of the /h/rest endpoint. Exploitation requires combining this with CVE-2026-50053, enabling an attacker with an ordinary Zimbra account to supply their own authentication token and document identifiers in a crafted URL. When a targeted signed-in user opens this URL, the injected JavaScript executes in their browser session, permitting the attacker to read mailbox data and perform authenticated actions on behalf of the victim. The issue was remediated in ZCS version 10.1.17.

Successful exploitation allows an attacker with a valid Zimbra account to execute arbitrary JavaScript in the context of another signed-in user's browser session. This leads to disclosure of mailbox data and the ability to perform actions authenticated as the victim user. The vulnerability has a high severity with CVSS 3.1 score of 8.7, indicating significant confidentiality and integrity impact but no availability impact.

A fix is available in Zimbra Collaboration Suite version 10.1.17. Users and administrators should upgrade from version 10.1.16 to 10.1.17 or later to remediate this vulnerability. No additional mitigation steps are indicated by the vendor advisory.