CVE-2026-50053: CWE-642 External Control of Critical State Data in Zimbra Zimbra Collaboration Suite

The vulnerability in Zimbra Collaboration Suite (ZCS) allows unauthenticated requests to the /h/* endpoint to override request attributes that are normally reserved for trusted internal use. The RestFilter component copies URL parameters such as authentication tokens, target account, target item, and dispatch state into request attributes consumed by the Classic Web Client. When combined with CVE-2026-10632 in ZCS 10.1.16, an attacker can supply a valid token and document identifiers to execute JavaScript in another user's browser session. ZCS 10.1.17 mitigates the XSS exploitation vector by changing the document renderer but does not fix the underlying request attribute override vulnerability.

This vulnerability allows an attacker to manipulate request attributes to impersonate or interfere with other users' sessions, potentially leading to cross-site scripting (XSS) attacks and unauthorized actions within the affected user's session. The CVSS score of 8.7 reflects high impact on confidentiality and integrity with network attack vector and low attack complexity. Availability is not affected.

No official patch or fix is indicated in the provided data. Since ZCS 10.1.17 blocks the XSS exploitation chain but retains the request attribute override, users should upgrade to at least 10.1.17 to mitigate the XSS risk. Further remediation for the request attribute override is not confirmed; therefore, monitor vendor advisories for updates. Implementing additional access controls or request validation may help reduce risk until a fix is available.