CVE-2026-33373: n/a
An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A Cross-Site Request Forgery (CSRF) vulnerability exists in Zimbra Web Client due to the issuance of authentication tokens without CSRF protection during certain account state transitions. Specifically, tokens generated after operations such as enabling two-factor authentication or changing a password may lack CSRF enforcement. While such a token is active, authenticated SOAP requests that trigger token generation or state changes can be performed without CSRF validation. An attacker could exploit this by inducing a victim to submit crafted requests, potentially allowing sensitive account actions such as disabling two-factor authentication. The issue is mitigated by ensuring CSRF protection is consistently enforced for all issued authentication tokens.
AI Analysis
Technical Summary
CVE-2026-33373 describes a CSRF vulnerability in Zimbra Collaboration Suite (ZCS) versions 10.0 and 10.1. The vulnerability occurs because authentication tokens generated after specific account state transitions lack CSRF enforcement. Consequently, authenticated SOAP requests that trigger token generation or state changes can be executed without CSRF validation. This enables an attacker to induce a victim to perform unauthorized sensitive account actions, including disabling two-factor authentication. The vulnerability is categorized under CWE-352 (Cross-Site Request Forgery) and carries a CVSS v3.1 score of 8.8, indicating high severity.
Potential Impact
Successful exploitation could allow an attacker to perform sensitive account modifications such as disabling two-factor authentication or changing account credentials by leveraging the lack of CSRF protection on certain authentication tokens. This compromises account integrity and confidentiality, potentially leading to full account takeover or unauthorized access.
Mitigation Recommendations
No official patch or vendor advisory is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Mitigation involves ensuring consistent CSRF protection enforcement on all authentication tokens issued during account state changes. Until an official fix is available, users should exercise caution with unsolicited links or requests while authenticated in Zimbra Web Client.
CVE-2026-33373: n/a
Description
An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A Cross-Site Request Forgery (CSRF) vulnerability exists in Zimbra Web Client due to the issuance of authentication tokens without CSRF protection during certain account state transitions. Specifically, tokens generated after operations such as enabling two-factor authentication or changing a password may lack CSRF enforcement. While such a token is active, authenticated SOAP requests that trigger token generation or state changes can be performed without CSRF validation. An attacker could exploit this by inducing a victim to submit crafted requests, potentially allowing sensitive account actions such as disabling two-factor authentication. The issue is mitigated by ensuring CSRF protection is consistently enforced for all issued authentication tokens.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-33373 describes a CSRF vulnerability in Zimbra Collaboration Suite (ZCS) versions 10.0 and 10.1. The vulnerability occurs because authentication tokens generated after specific account state transitions lack CSRF enforcement. Consequently, authenticated SOAP requests that trigger token generation or state changes can be executed without CSRF validation. This enables an attacker to induce a victim to perform unauthorized sensitive account actions, including disabling two-factor authentication. The vulnerability is categorized under CWE-352 (Cross-Site Request Forgery) and carries a CVSS v3.1 score of 8.8, indicating high severity.
Potential Impact
Successful exploitation could allow an attacker to perform sensitive account modifications such as disabling two-factor authentication or changing account credentials by leveraging the lack of CSRF protection on certain authentication tokens. This compromises account integrity and confidentiality, potentially leading to full account takeover or unauthorized access.
Mitigation Recommendations
No official patch or vendor advisory is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Mitigation involves ensuring consistent CSRF protection enforcement on all authentication tokens issued during account state changes. Until an official fix is available, users should exercise caution with unsolicited links or requests while authenticated in Zimbra Web Client.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- mitre
- Date Reserved
- 2026-03-19T00:00:00.000Z
- Cvss Version
- null
- State
- PUBLISHED
Threat ID: 69ca9568e6bfc5ba1d43cfd0
Added to database: 3/30/2026, 3:23:20 PM
Last enriched: 4/7/2026, 9:42:43 AM
Last updated: 5/14/2026, 2:54:00 PM
Views: 128
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.