CVE-2026-50057: CWE-732 Incorrect Permission Assignment for Critical Resource in Zimbra Zimbra Collaboration Suite

This vulnerability (CVE-2026-50057) in Zimbra Collaboration Suite's MTA package involves incorrect permission assignment (CWE-732) that allows local privilege escalation. The installed sudo policy allows the zimbra Unix account to run Postfix administration commands as root without password and without restricting command arguments. An attacker with local zimbra user privileges can manipulate the Postfix configuration directory, which is writable by zimbra, to execute arbitrary post-install programs as root by invoking 'postfix set-permissions'. This misconfiguration leads to root-level command execution from a lower-privileged user context. The affected versions include all ZCS versions from initial releases up to 10.1.21.

Successful exploitation grants an attacker with local access as the zimbra user full root privileges on the affected system. This compromises system integrity, confidentiality, and availability, allowing arbitrary code execution with the highest privileges. The vulnerability is rated high severity with a CVSS 3.1 score of 7.8, reflecting its significant impact on confidentiality, integrity, and availability.

No official patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict local access to the zimbra user account and carefully audit sudo policies related to Postfix administration commands. Avoid running untrusted code as the zimbra user and monitor for unauthorized changes to the Postfix configuration directory.