This vulnerability involves improper neutralization of input during web page generation (CWE-79) in Zimbra Collaboration Suite (ZCS). An unauthenticated sender can craft a malicious share notification that, when accepted by a signed-in user using the Zimbra Modern interface, triggers stored XSS. The attacker can then access sensitive mailbox data and perform actions as the victim user. The CVSS 3.1 score is 9.3 (critical), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality and integrity.

Successful exploitation allows an unauthenticated attacker to execute stored cross-site scripting in the context of the victim's browser session, leading to unauthorized access to mailbox data and the ability to act as the victim user within Zimbra Collaboration Suite. This compromises confidentiality and integrity of user data without affecting availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when accepting share notifications from untrusted sources. Monitor vendor communications for updates on patches or official mitigations.