CVE-2026-93629: CWE-290 Authentication bypass by spoofing in Zimbra Zimbra Collaboration Suite

This vulnerability in Zimbra Collaboration Suite (ZCS) arises because the email delivery path permits external calendar invitations but does not verify that the sender is authorized to use the iCalendar ORGANIZER identity. When automatic invitation insertion is enabled, an unauthenticated attacker can craft a REQUEST component that creates an event with attacker-controlled meeting details and reminders under a forged organizer identity. The recipient's calendar receives the event without requiring any interaction, but the claimed organizer's calendar does not reflect the event. Affected versions include all ZCS versions from 0 up to and including 10.1.21.

An unauthenticated attacker can insert calendar events into a recipient's calendar with a forged organizer identity. This can lead to misinformation or social engineering risks by presenting false meeting details. However, the vulnerability does not allow modification of the organizer's calendar or compromise confidentiality or availability. The impact is limited to integrity of calendar invitations.

No official patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling automatic invitation insertion or implementing email filtering rules to block suspicious calendar invitations.