CVE-2026-93639: CWE-862 Missing Authorization in Zimbra Zimbra Collaboration Suite

This vulnerability in Zimbra Collaboration Suite (ZCS) arises from missing authorization checks that permit a delegated administrator lacking explicit administrative grants to overwrite global Zimlet configurations through the ConfigureZimletRequest. The attacker can insert a domain they control into the proxy allowlist of the default class of service. When a signed-in user belonging to that class opens a specially crafted /service/proxy URL, Zimbra serves attacker-controlled HTML under its origin, allowing JavaScript to access mailbox data and perform authenticated actions as the victim. Exploitation requires both a delegated administrator account with access to the admin SOAP service and the victim opening the malicious URL. Affected versions include all ZCS versions from initial releases up to and including 10.1.20.

Successful exploitation can lead to unauthorized modification of global Zimlet configurations and insertion of attacker-controlled domains into proxy allowlists. This enables cross-origin scripting attacks that can read mailbox data and perform actions with the victim's privileges, compromising confidentiality and integrity of user data. The attack requires a delegated administrator account and victim interaction, limiting but not negating the risk. The CVSS score of 8.7 reflects high impact on confidentiality and integrity.

No official patch or fix information is provided in the vendor advisory or input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict delegated administrator privileges to trusted users only and monitor for suspicious ConfigureZimletRequest activity. Educate users about the risk of opening untrusted URLs. Avoid granting delegated administrator accounts unnecessary access to the admin SOAP service.