A mailbox quota-accounting vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to consume another user’s mailbox quota by repeatedly sharing and revoking a document. Creation of the recipient’s shared-file record charges the document size to mailbox-wide usage. Revocation deletes the record and reverses its folder counters without reversing the mailbox-wide charge. Repeated normal share notifications therefore accumulate quota usage after the visible records are gone. On accounts with a finite quota, this can prevent incoming mail and other size-increasing operations without recipient interaction. The issue affects ZCS 10.1.16 and 10.1.20.
An SMTP command injection vulnerability in the data-source testing functionality of Zimbra Collaboration Suite (ZCS) allows an ordinary authenticated user with account options enabled to inject CR/LF into the emailAddress inserted into an SMTP envelope command by a JSON SOAP request. After a successful preliminary POP3 or IMAP login, Zimbra sends the injected commands to the selected SMTP service. If that service accepts the pipelined transaction, the attacker can submit mail with attacker-selected recipients, headers and body content without victim interaction. The vulnerable command-construction path is present in ZCS 10.1.16 and 10.1.20.
An LDAP filter injection vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to query otherwise unreturned attributes of calendar resources through SearchCalendarResourcesRequest. Zimbra escapes search values but inserts the supplied attribute names directly into LDAP filter expressions without validation. An attacker can inject additional conditions and use repeated matching queries to recover readable resource attributes such as internal mailbox hostnames and mail transport routes. The search remains restricted to calendar-resource objects and the LDAP service account's access rights. ZCS 10.1.16 and 10.1.21 are affected.
A cross-account authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to insert forged shared-file records into another user's mailbox through FileSharedWithMeRequest. The request bypasses delegated-account authorization and accepts attacker-selected file metadata, owner identifiers and declared sizes without validating a corresponding document share. An attacker can plant entries attributed to another real local account without that account sharing a document. No victim interaction is required. ZCS 10.1.16 and 10.1.20 are affected.
A CSS sanitization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user with Briefcase access to publish a document that displays attacker-controlled content under the Zimbra origin. When processing a stylesheet containing non-ASCII characters, DefangFilter appends the final ASCII segment without sanitizing it. HTML stored as application/x-zimbra-doc can therefore retain CSS URL references that the normal sanitizer removes. An attacker can share a crafted document that loads external resources and displays a credential-collection form using Zimbra's own visual assets. Exploitation requires the victim to open the document in a browser that renders the content type inline; credential theft additionally requires form submission. ZCS 10.1.16 and 10.1.20 are affected.
A hostname canonicalization vulnerability in the email HTML sanitizers of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to bypass the restriction on forms that target the Zimbra host. DefangFilter and the OWASP ActionAttributePolicy compare the form-action hostname with the request hostname before browser URL canonicalization. A percent-encoded hostname can therefore survive sanitization while the browser submits the form to the normal Zimbra origin with the recipient's authentication cookie. This permits authenticated form requests from a crafted email after the recipient opens it in Classic and submits the form. The issue is present in ZCS 10.1.16 and 10.1.21. It does not bypass an endpoint's CSRF-token checks; a state-changing attack additionally requires an endpoint that accepts the resulting request without that protection.
An organizer authentication vulnerability in Zimbra Collaboration Suite (ZCS) allows an unauthenticated email sender to insert calendar invitations attributed to another user. The email delivery path permits external invitations but does not verify that the message sender is authorized to use the iCalendar ORGANIZER identity. When automatic invitation insertion is enabled, a crafted REQUEST component creates an event containing attacker-selected meeting details and reminders under a forged organizer without recipient interaction. No corresponding event is created in the claimed organizer's calendar. ZCS 10.1.16 and 10.1.21 are affected.
An attendee authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to forge another attendee's response to an existing meeting. Zimbra passes a null sender identity when processing iCalendar REPLY components, causing the attendee authorization filter to be skipped. An attacker who knows the meeting UID, organizer address and attendee address can send a non-outdated reply that changes the attendee's participation status in the organizer's calendar. The change occurs automatically during delivery without organizer or attendee interaction. ZCS 10.1.16 and 10.1.21 are affected.
An organizer authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to cancel or modify an existing meeting in a recipient's calendar. Zimbra accepts iCalendar CANCEL and REQUEST components without verifying that the email sender is authorized to act as the supplied organizer. An attacker who knows the meeting UID and organizer address can supply a non-outdated sequence number to move the recipient's meeting to Trash or replace its details. Processing occurs automatically during email delivery without recipient interaction. ZCS 10.1.16 and 10.1.21 are affected.
A request attribute override vulnerability in Zimbra Collaboration Suite (ZCS) allows unauthenticated requests to /h/* to populate servlet attributes intended for trusted internal dispatch. RestFilter copies URL parameters specifying an authentication token, target account, target item and dispatch state into the request attributes consumed by the Classic Web Client. Combined with CVE-2026-10632 on ZCS 10.1.16, this allows an attacker to supply their own valid token and document identifiers and execute JavaScript in another user's signed-in browser session. ZCS 10.1.17 blocks that XSS chain by changing the document renderer, but retains the request attribute override.
CVE-2026-93637 is a low-severity vulnerability in Zimbra Collaboration Suite versions up to 10.1.21. It involves an authentication rate-limit bypass via GraphQL aliases, allowing unauthenticated attackers to perform multiple password guesses in a single HTTP request without incrementing the source-IP failure counter.
CVE-2026-93635 is an LDAP injection vulnerability in Zimbra Collaboration Suite versions up to 10.1.21. It allows unauthenticated attackers to manipulate external LDAP search filters, potentially enabling a password oracle for external directory users on domains using search-filter authentication and lazy provisioning. Authenticated S/MIME lookups may also expose certificates and identity data for unintended directory entries. The vulnerability has a medium severity with a CVSS score of 5.3.
CVE-2026-50055 is a medium severity vulnerability in Zimbra Collaboration Suite that allows an authenticated user to bypass disabled mail forwarding. This occurs due to a policy-enforcement flaw where the user can use a Sieve notify action to send copies of email content and headers to an arbitrary address. The vulnerability affects versions prior to 10.1.20. There is no indication of active exploitation in the wild or an official patch available at this time.
CVE-2026-50054 is an authorization vulnerability in Zimbra Collaboration Suite affecting versions before 10.1.20. It allows an authenticated attacker to grant another local account the loginAs right, enabling persistent mailbox access and mail-sending capabilities that persist beyond password changes and session expirations. The vulnerability has a high severity with a CVSS score of 7.1.
CVE-2026-10631 is an authorization bypass vulnerability in Zimbra Collaboration Suite versions 10.1.0 through 10.1.19. It affects the EWS FindItem handler, allowing an authenticated user with EWS enabled to read complete mailbox items, including raw MIME and attachments, from arbitrary local accounts without proper share or delegation permissions. The vulnerability has a CVSS score of 6.5, indicating medium severity.
An unauthenticated calendar sender can place active markup in a COUNTER message's RFC From address. Selecting the message in Zimbra Classic triggers stored XSS, allowing the attacker to access mailbox data and act as the victim.
CVE-2026-93643 is a critical path traversal vulnerability in Zimbra Collaboration Suite (ZCS) affecting versions prior to 10.1.21. It allows an unauthenticated remote attacker with access to a supported public Briefcase document to abuse unsigned save fields, enabling path-traversal writes and command execution as the zimbra user. The vulnerability arises when OnlyOffice/Document Editing is enabled. The CVSS 3.1 score is 9.8, indicating high impact on confidentiality, integrity, and availability.
CVE-2026-93642 is a critical stored cross-site scripting (XSS) vulnerability in Zimbra Collaboration Suite (ZCS). An unauthenticated attacker can forge a share notification that triggers stored XSS when a signed-in user clicks Accept Share. This allows the attacker to access mailbox data and act on behalf of the victim user.
CVE-2026-93641 is a critical stored cross-site scripting (XSS) vulnerability in Zimbra Collaboration Suite (ZCS) versions before 10.1.21. An unauthenticated attacker can send a forged share notification that triggers XSS when a signed-in Zimbra Classic user clicks Accept Share. This allows the attacker to access mailbox data and act on behalf of the victim.
In Zimbra Collaboration (ZCS) before 10.1.17, weak cryptographic key generation vulnerability exists in the OnlyOffice integration. The zimbraDocumentEditingJwtSecret is generated using an insecure random number generator, resulting in insufficient entropy. An attacker who obtains a JWT signed with the generated secret may be able to recover the JWT signing secret through offline brute-force, potentially enabling JWT forgery.