CVE-2026-93630
MEDIUM 4.3A hostname canonicalization vulnerability in the email HTML sanitizers of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to bypass the restriction on forms that target the Zimbra host. DefangFilter and the OWASP ActionAttributePolicy compare the form-action hostname with the request hostname before browser URL canonicalization. A percent-encoded hostname can therefore survive sanitization while the browser submits the form to the normal Zimbra origin with the recipient's authentication cookie. This permits authenticated form requests from a crafted email after the recipient opens it in Classic and submits the form. The issue is present in ZCS 10.1.16 and 10.1.21. It does not bypass an endpoint's CSRF-token checks; a state-changing attack additionally requires an endpoint that accepts the resulting request without that protection.
No known exploitation, public exploit, or elevated probability at this time. Track for changes.
Exploitation likelihood
0.3%chance of exploitation in 30 days · 21st percentile
Impact if exploited
4.3CVSS 3.1 · MEDIUM
- ConfidentialityNone
- IntegrityLow
- AvailabilityNone
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ✓Privileges: No account or privileges required
- ⚠User interaction: A user must take an action (click / open a file)
- ✓Complexity: No special conditions — reliably repeatable
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Data snapshot:
Weakness (CWE)
- CWE-180: Incorrect behavior order: validate before canonicalize
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References and research data (JSON)
All CVSS metrics
- MEDIUM 4.3 v3.1 · CNA Primary
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - MEDIUM 4.3 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References
Advisories
- https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories CVE record · rapid7 · Updated 2026-10-23T13:21:39.551Z
NVD · CVE-2026-93630 · Updated 2026-10-23T16:44:17.950 - https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-108971 EUVD · EUVD-2026-108971
Technical & other
- https://www.rapid7.com/blog/post/ve-breaking-zimbra-identity-boundaries-part-1/ CVE record · rapid7 · Updated 2026-10-23T13:21:39.551Z
NVD · CVE-2026-93630 · Updated 2026-10-23T16:44:17.950