CVE-2026-93634: CWE-639 Authorization bypass through User-Controlled key in Zimbra Zimbra Collaboration Suite

This vulnerability in Zimbra Collaboration Suite (ZCS) involves a cross-account authorization bypass through the FileSharedWithMeRequest API. An authenticated attacker can forge shared-file records in another user's mailbox by supplying arbitrary file metadata, owner identifiers, and declared sizes. The system fails to verify that the document is genuinely shared by the purported owner, allowing the attacker to plant entries attributed to other local accounts without their consent or knowledge. The flaw affects ZCS versions from the initial release through 10.1.20. There is no evidence of exploitation in the wild, and no victim interaction is necessary for the attack to succeed.

An attacker with valid authentication can manipulate mailbox contents of other users by inserting forged shared-file records. This could lead to confusion or potential misuse of mailbox data, but does not directly impact confidentiality or availability. The integrity of mailbox metadata is compromised, but no direct data disclosure or denial of service is indicated by the available information.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user privileges where possible and monitor for unusual mailbox metadata changes related to shared files.