CVE-2026-93627: CWE-290 Authentication bypass by spoofing in Zimbra Zimbra Collaboration Suite

This vulnerability in Zimbra Collaboration Suite (ZCS) allows an unauthenticated attacker to spoof the organizer of a calendar meeting by sending crafted iCalendar CANCEL or REQUEST components. Zimbra does not verify that the sender is authorized to act as the meeting organizer, enabling the attacker to cancel or modify existing meetings in the recipient's calendar. The attacker must know the meeting UID and organizer address and provide a valid sequence number to effect changes. The processing of these calendar components happens automatically during email delivery without recipient interaction. Affected versions include ZCS 10.1.16 through 10.1.21.

An attacker can cancel or modify meetings in a recipient's calendar without authentication, potentially disrupting scheduling and causing confusion. The integrity of calendar data is compromised, but confidentiality and availability are not directly affected. There is no indication of data disclosure or denial of service from this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, organizations should consider monitoring calendar-related email traffic for suspicious CANCEL or REQUEST messages and apply any recommended vendor mitigations once published.