CVE-2026-93640: CWE-732 Incorrect Permission Assignment for Critical Resource in Zimbra Zimbra Collaboration Suite

This vulnerability arises from incorrect permission assignment in the dnscache package of Zimbra Collaboration Suite (ZCS). The zimbra Unix account can leverage a passwordless sudo policy that permits arbitrary arguments to the zmunbound wrapper, which forwards these arguments to the Unbound DNS resolver without restricting the configuration path. An attacker can supply a crafted configuration that disables chroot and retains root privileges. The use of include directives can expose root-readable files through parser errors, and attacker-controlled logfile paths can create or append to root-owned files. This leads to potential disclosure of sensitive information such as password hashes and private keys, as well as corruption of privileged configuration files that can prevent affected services from starting properly. The affected versions include ZCS 10.1.16 through 10.1.21 dnscache packages.

Successful exploitation results in local privilege escalation from the zimbra user to root privileges. This can lead to disclosure of sensitive information including password hashes and private keys, and can cause denial of service by corrupting configuration files and preventing services from starting. The CVSS v3.1 score is 7.8, indicating a high severity impact on confidentiality, integrity, and availability.

No patch links or vendor advisories are provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the zimbra account and the dnscache package, and monitor for unauthorized local access. Avoid running untrusted configurations with zmunbound and consider disabling or limiting the dnscache package if not required.