CVE-2026-93636: CWE-90 Improper neutralization of special elements used in an LDAP query ('LDAP injection') in Zimbra Zimbra Collaboration Suite

This vulnerability involves improper neutralization of special elements in LDAP queries (CWE-90) within Zimbra Collaboration Suite. Authenticated users can exploit the SearchCalendarResourcesRequest API to inject additional LDAP filter conditions by manipulating attribute names that are directly inserted into LDAP filter expressions without validation. While search values are escaped, the lack of validation on attribute names enables injection. This can lead to unauthorized reading of calendar resource attributes such as internal mailbox hostnames and mail transport routes. The scope of the search and data exposure is limited by the LDAP service account's access rights and restricted to calendar-resource objects. Affected versions include all ZCS versions up to and including 10.1.21.

An authenticated attacker can leverage this LDAP injection vulnerability to read additional attributes of calendar resources that are normally not returned. This may disclose sensitive internal information such as mailbox hostnames and mail transport routes. However, the impact is limited to data accessible by the LDAP service account and restricted to calendar-resource objects. There is no indication of integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the SearchCalendarResourcesRequest API to trusted authenticated users only and monitor for suspicious query patterns. Avoid exposing this functionality to untrusted users. Follow vendor guidance once published.