As cited
Copy frozen at (site build).
vulnerabilities
From One Account to Every Mailbox: Breaking Zimbra's Identity Boundaries (Part 1)
Rapid7 disclosed over 80 vulnerabilities in Zimbra Collaboration Suite spanning authentication, mailbox authorization, and other components, with five account-related CVEs analyzed in Part 1. The findings include a GraphQL authentication rate-limit bypass that allows password guessing without IP-based blocking, LDAP filter injection, email impersonation via SaveDraftRequest, Exchange Web Services cross-user mailbox access, and a Sieve forwarding-restriction bypass. Fixes are available in ZCS 10.1.17 and 10.1.20, though two pre-authentication flaws lack public patches as of October 14, 2026.
Why it matters: Organizations running Zimbra Collaboration Suite should immediately patch to ZCS 10.1.20 or later; CVE-2026-73571, CVE-2026-10631, and CVE-2026-50055 allow authenticated and unauthenticated attackers to impersonate users, read private mailbox contents, and exfiltrate email despite forwarding restrictions. Administrators must inspect server-side filter rules for unauthorized notify actions and review EWS logs for cross-user access patterns, as password changes alone do not remove compromised server state.
- Source published
- First seen by Cybersecurity Tracker