CVE-2026-93630: CWE-180 Incorrect behavior order: validate before canonicalize in Zimbra Zimbra Collaboration Suite

This vulnerability arises from incorrect behavior order in Zimbra Collaboration Suite's email HTML sanitizers, specifically validating before canonicalizing hostnames in form actions. The DefangFilter and OWASP ActionAttributePolicy compare the form-action hostname with the request hostname before browser URL canonicalization, allowing a percent-encoded hostname to evade sanitization. Consequently, a malicious email can include a form that appears safe but submits authenticated requests to the Zimbra origin when the recipient interacts with it. The issue is present in ZCS versions from initial releases up to but excluding 10.1.21. Exploitation requires user interaction and does not bypass CSRF-token protections, limiting the scope of potential attacks.

An attacker can craft an email that includes a form targeting the Zimbra host, bypassing hostname restrictions due to improper validation order. When the recipient opens the email and submits the form, the browser sends authenticated requests with the recipient's cookie to the Zimbra server. This can lead to unauthorized actions with the recipient's privileges if the targeted endpoint lacks CSRF-token checks. The vulnerability does not affect confidentiality or availability directly and requires user interaction.

No official patch or fix is currently confirmed for this vulnerability. Users should check the vendor advisory for updates. Since the vulnerability does not bypass CSRF-token protections, ensuring all state-changing endpoints enforce CSRF tokens mitigates the risk. Additionally, users should exercise caution when interacting with forms in emails. Monitoring vendor communications for an official fix is recommended.