Vulnerability · Published Oct 23, 2026 · Assigned by rapid7
CVE-2026-93634Zimbra Collaboration Suite Cross-Account Authorization Bypass via Forged Shared-File Records
Medium 4.3
In plain English
A medium-severity authorization bypass via user-controlled key in Zimbra Collaboration Suite from Zimbra. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).
Official description
A cross-account authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to insert forged shared-file records into another user's mailbox through FileSharedWithMeRequest. The request bypasses delegated-account authorization and accepts attacker-selected file metadata, owner identifiers and declared sizes without validating a corresponding document share. An attacker can plant entries attributed to another real local account without that account sharing a document. No victim interaction is required. ZCS 10.1.16 and 10.1.20 are affected.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Zimbra | Zimbra Collaboration Suite | 0 – through 10.1.20 |
Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N