CVE-2026-115786: CWE-682 Incorrect Calculation in Zimbra Zimbra Collaboration Suite

This vulnerability in Zimbra Collaboration Suite (ZCS) involves incorrect quota accounting when a document is shared and then revoked. The creation of a shared-file record charges the recipient's mailbox quota by the document size. However, revoking the share deletes the record and reverses folder counters but fails to reverse the mailbox-wide quota charge. As a result, repeated sharing and revocation cause the mailbox quota usage to accumulate erroneously, potentially exhausting the recipient's quota and preventing incoming mail or other size-increasing operations. The issue affects ZCS versions from 0 up to and including 10.1.20.

The vulnerability allows an authenticated user to consume another user's mailbox quota without their interaction, leading to denial of service conditions such as preventing incoming mail and other mailbox size-increasing operations. There is no direct confidentiality or integrity impact reported. The impact is availability-related, causing disruption of normal mailbox functionality on accounts with finite quotas.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, monitoring quota usage and limiting sharing privileges may help mitigate the risk.