CVE-2026-93639
HIGH 8.7A missing authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows a delegated administrator with no explicit administrative grants to overwrite global Zimlet configuration through ConfigureZimletRequest. The uploaded configuration can also add an attacker-controlled domain to the proxy allowlist of the default class of service. If a signed-in user in that class opens a crafted /service/proxy URL, Zimbra serves attacker-controlled HTML under its own origin. The resulting JavaScript can read mailbox data and perform authenticated actions as the victim. Exploitation requires a delegated-administrator account and access to the admin SOAP service; the browser compromise additionally requires the victim to open the crafted URL. ZCS 10.1.16 and 10.1.20 are affected.
Severe if exploited (CVSS 8.7), but no known exploitation and low modeled probability. Patch on a normal cadence.
Exploitation likelihood
0.4%chance of exploitation in 30 days · 31st percentile
Impact if exploited
8.7CVSS 3.1 · HIGH
- ConfidentialityHigh
- IntegrityHigh
- AvailabilityNone
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ⚠Privileges: Requires a low-privilege account
- ⚠User interaction: A user must take an action (click / open a file)
- ✓Complexity: No special conditions — reliably repeatable
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Data snapshot:
Weakness (CWE)
- CWE-862: Missing Authorization
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
References and research data (JSON)
All CVSS metrics
- HIGH 8.7 v3.1 · CNA Primary
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N - HIGH 8.7 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
References
Advisories
- https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories CVE record · rapid7 · Updated 2026-10-23T13:29:25.939Z
NVD · CVE-2026-93639 · Updated 2026-10-23T16:44:17.950 - https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-108978 EUVD · EUVD-2026-108978
Technical & other
- https://www.rapid7.com/blog/post/ve-breaking-zimbra-identity-boundaries-part-1/ CVE record · rapid7 · Updated 2026-10-23T13:29:25.939Z
NVD · CVE-2026-93639 · Updated 2026-10-23T16:44:17.950