CVE-2026-93639
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
A missing authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows a delegated administrator with no explicit administrative grants to overwrite global Zimlet configuration through ConfigureZimletRequest. The configuration can add an attacker-controlled domain to the proxy allowlist of the default class of service; if a signed-in user opens a crafted /service/proxy URL, Zimbra serves attacker-controlled HTML under its own origin, enabling mailbox data theft and authenticated actions as the victim.
Risk Assessment
A delegated administrator can enable session compromise and theft of mailbox data and perform actions as the victim, impacting confidentiality and integrity.
Recommendation
Update ZCS to the patched version. Restrict delegated administrator privileges and review Zimlet configuration and proxy allowlists.
Other vulnerabilities in Zimbra Collaboration Suite (ZCS)
See all- CVE-2017-6821Critical
Directory traversal vulnerability in Zimbra Collaboration Suite (ZCS) before version 8.7.6 allows attackers to have unspecified impact via unknown vectors.
- CVE-2017-6813Critical
A service provided by Zimbra Collaboration Suite (ZCS) before version 8.7.6 fails to require needed privileges before performing a few requested operations.
- CVE-2016-9924Critical
Zimbra Collaboration Suite (ZCS) before version 8.7.4 allows remote attackers to conduct XML External Entity (XXE) attacks.
Original NVD description (English source)
A missing authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows a delegated administrator with no explicit administrative grants to overwrite global Zimlet configuration through ConfigureZimletRequest. The uploaded configuration can also add an attacker-controlled domain to the proxy allowlist of the default class of service. If a signed-in user in that class opens a crafted /service/proxy URL, Zimbra serves attacker-controlled HTML under its own origin. The resulting JavaScript can read mailbox data and perform authenticated actions as the victim. Exploitation requires a delegated-administrator account and access to the admin SOAP service; the browser compromise additionally requires the victim to open the crafted URL. ZCS 10.1.16 and 10.1.20 are affected.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS