CVE-2026-93631: CWE-352 Cross-Site request forgery (CSRF) in Zimbra Zimbra Collaboration Suite

The vulnerability arises because the OAuth callback in Zimbra Collaboration Suite does not bind the state value or authorization code to the initiating Zimbra session. Instead, it uses the mailbox identified by the browser's current authentication cookie. An attacker can trick a signed-in victim into loading a callback with a fresh code for the attacker's provider account, linking the attacker's external account to the victim's mailbox. This linkage creates a persistent data source that imports attacker-controlled contacts or events. With bidirectional CalDAV synchronization enabled, appointments created or edited in the linked calendar can be disclosed to the attacker. The affected versions include ZCS 10.1.16 through 10.1.20.

Successful exploitation can lead to unauthorized linkage of an attacker-controlled external account to a victim's mailbox, enabling persistent import of malicious contacts or calendar events. This can result in partial disclosure of calendar appointments to the attacker. The confidentiality of calendar data is compromised (high impact on confidentiality), while integrity is impacted to a lesser extent (attacker can inject data). Availability is not affected.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious about unsolicited links that may trigger OAuth callbacks and consider disabling or restricting OAuth extensions if feasible.