An authorization bypass in the EWS FindItem handler of Zimbra Collaboration Suite 10.1.0 through 10.1.19 allows an authenticated user with EWS… (CVE-2026-10631)

An authorization bypass vulnerability exists in the EWS FindItem handler of Zimbra Collaboration Suite versions 10.1.0 through 10.1.19. Authenticated users with EWS enabled can exploit this flaw to read mailbox contents of arbitrary local accounts without having share or delegation rights. The vulnerability is identified as CVE-2026-10631 and is associated with CWE-639 (Authorization Bypass). The CVSS v3.1 base score is 6.5, indicating a medium severity, with network attack vector, low attack complexity, and requiring low privileges but no user interaction. Confidentiality impact is high, while integrity and availability impacts are none.

An attacker who is authenticated and has EWS enabled can bypass authorization controls to read sensitive mailbox data from other local accounts. This includes full mailbox items, raw MIME data, and attachments, potentially exposing confidential information without proper permissions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict EWS access to trusted users only and monitor for unusual mailbox access patterns. Do not assume the vulnerability is mitigated without vendor confirmation.