A cross-account authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to insert forged shared-file records into another user's mailbox through FileSharedWithMeRequest. The request bypasses delegated-account authorization and accepts attacker-selected file metadata, owner identifiers and declared sizes without validating a corresponding document share. An attacker can plant entries attributed to another real local account without that account sharing a document. No victim interaction is required. ZCS 10.1.16 and 10.1.20 are affected.
Fix
Patch, vendor advisory and mitigation references on NVD 1
- https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 11
- Cpes+1 CPE criteria (now 1)NVD modified 2026-10-28 21:21
- StatusPublished → AnalyzedNVD modified 2026-10-28 21:21
- StatusUndergoing Analysis → PublishedNVD modified 2026-10-28 19:50
- StatusPublished → Undergoing AnalysisNVD modified 2026-10-28 20:18
- StatusUndergoing Analysis → PublishedNVD modified 2026-10-28 19:50
- StatusPublished → Undergoing AnalysisNVD modified 2026-10-28 20:18
- StatusAwaiting Analysis → PublishedNVD modified 2026-10-23 13:26
- StatusPublished → Awaiting AnalysisNVD modified 2026-10-23 16:44
- StatusReceived → PublishedNVD modified 2026-10-23 13:26
- StatusPublished → ReceivedNVD modified 2026-10-23 14:17
- First seenCVSS 4.3 · zimbraNVD modified 2026-10-23 13:26
Affected (CPE criteria) 1
cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*
References 2
- https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories Vendor Advisory
- https://www.rapid7.com/blog/post/ve-breaking-zimbra-identity-boundaries-part-1/ Exploit, Third Party Advisory