Zimbra Collaboration Suite Cross-Account Authorization Bypass via Forged Shared-File Records

published 2026-10-23 17 d ago modified 2026-10-28 11 d ago also EUVD-2026-108974

cvss: 4.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 19%
public exploits: 0; none known

A cross-account authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to insert forged shared-file records into another user's mailbox through FileSharedWithMeRequest. The request bypasses delegated-account authorization and accepts attacker-selected file metadata, owner identifiers and declared sizes without validating a corresponding document share. An attacker can plant entries attributed to another real local account without that account sharing a document. No victim interaction is required. ZCS 10.1.16 and 10.1.20 are affected.

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 11 d ago (2026-10-28)

Exploit prediction

0.27% chance of exploitation in the next 30 days, higher than 19% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

rapid7.com https://www.rapid7.com/blog/post/ve-breaking-zimbra-identity-boundaries-part-1/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Affected products

Zimbra Zimbra Collaboration Suite

Classification

Weakness

CWE-639 Authorization Bypass Through User-Controlled Key

References

rapid7.com /blog/post/ve-breaking-zimbra-identity-boundaries-part-1/
related, exploit, third-party-advisory
wiki.zimbra.com /wiki/Zimbra_Security_Advisories
vendor-advisory

Sources

CVE List CVE-2026-93634
NVD CVE-2026-93634

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary