Skip to content
OpenAdvisories
High WID-SEC-2026-4144 17 CVEs

Synacor Zimbra Collaboration Suite: Mehrere Schwachstellen

Published Oct 25, 2026 · Updated Oct 25, 2026 · de-DE

Vendor: Synacor Product: Zimbra

Summary

Ein Angreifer kann mehrere Schwachstellen in Synacor Zimbra ausnutzen, um sich erweiterte Berechtigungen – einschließlich Root-Rechte – zu verschaffen, Sicherheitsmaßnahmen zu umgehen, Spoofing- und Cross-Site-Scripting-Angriffe durchzuführen, sensible Daten zu manipulieren oder offenzulegen oder einen Denial-of-Service-Zustand auszulösen.

Product

Zimbra ist eine Groupware-Lösung, die E-Mail, Kalender und Aufgabenverwaltung bietet.

Vulnerabilities 17

  • High 8.7
    CVE-2026-10632

    Zimbra Collaboration Suite Classic Web Client Reflected Cross-Site Scripting via Document Editor Packages Parameter

    A reflected cross-site scripting vulnerability in the Classic Web Client of Zimbra Collaboration Suite (ZCS) allows an attacker to inject JavaScript through the packages parameter of the /h/rest document editor. The editor inserts package names into script at…

    Zimbra Zimbra Collaboration Suite
  • High 8.7
    CVE-2026-50053

    Zimbra Collaboration Suite RestFilter Request Attribute Override via Unauthenticated URL Parameters

    A request attribute override vulnerability in Zimbra Collaboration Suite (ZCS) allows unauthenticated requests to /h/* to populate servlet attributes intended for trusted internal dispatch. RestFilter copies URL parameters specifying an authentication token, …

    Zimbra Zimbra Collaboration Suite
  • High 8.7
    CVE-2026-93639

    Zimbra Collaboration Suite Missing Authorization in ConfigureZimlet Enables Delegated Administrator Privilege Escalation

    A missing authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows a delegated administrator with no explicit administrative grants to overwrite global Zimlet configuration through ConfigureZimletRequest. The uploaded configuration can also add …

    Zimbra Zimbra Collaboration Suite
  • High 7.8
    CVE-2026-50056

    Zimbra Collaboration Suite Local Privilege Escalation via zmmailboxdmgr JVM Argument Injection

    A local privilege escalation vulnerability in the zmmailboxdmgr launcher of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to execute arbitrary commands as root. The passwordless sudo interface accepts JVM arguments that are not adequately re…

    Zimbra Zimbra Collaboration Suite
  • High 7.8
    CVE-2026-50057

    Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted Postfix Sudo Permissions

    A local privilege escalation vulnerability in the Zimbra Collaboration Suite (ZCS) MTA package allows the Unix zimbra account to execute arbitrary commands as root. The installed sudo policy permits passwordless root execution of Postfix administration comman…

    Zimbra Zimbra Collaboration Suite
  • High 7.8
    CVE-2026-93640

    Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted zmunbound Sudo Configuration

    A local privilege escalation vulnerability in the optional dnscache package of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to access files with root privileges. The passwordless sudo policy permits arbitrary arguments to zmunbound, whose w…

    Zimbra Zimbra Collaboration Suite
  • High 7.1
    CVE-2026-93631

    Zimbra Collaboration Suite OAuth Extension Cross-Site Request Forgery Enables Account Linking

    A cross-site request forgery vulnerability in the OAuth extension of Zimbra Collaboration Suite (ZCS) Network Edition allows an attacker to link an attacker-controlled external account to a victim's mailbox. The OAuth callback does not bind its state value or…

    Zimbra Zimbra Collaboration Suite
  • Medium 6.5
    CVE-2026-115786

    Zimbra Collaboration Suite Shared-File Mailbox Quota Accounting Error Enables Quota Exhaustion

    A mailbox quota-accounting vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to consume another user’s mailbox quota by repeatedly sharing and revoking a document. Creation of the recipient’s shared-file record charges the documen…

    Zimbra Zimbra Collaboration Suite
  • Medium 6.1
    CVE-2026-93638

    Zimbra Collaboration Suite Pre-Authentication Reflected Cross-Site Scripting via Login Page zrememberme Parameter

    A reflected cross-site scripting vulnerability in the login page of Zimbra Collaboration Suite (ZCS) allows an unauthenticated attacker to execute JavaScript through the zrememberme parameter. A crafted relogin URL selects a two-factor error display that inse…

    Zimbra Zimbra Collaboration Suite
  • Medium 5.4
    CVE-2026-93633

    Zimbra Collaboration Suite Briefcase CSS Sanitization Bypass via Non-ASCII Stylesheet Characters

    A CSS sanitization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user with Briefcase access to publish a document that displays attacker-controlled content under the Zimbra origin. When processing a stylesheet containing non-ASCII …

    Zimbra Zimbra Collaboration Suite
  • Medium 5.3
    CVE-2026-93627

    Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar CANCEL/REQUEST Organizer

    An organizer authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to cancel or modify an existing meeting in a recipient's calendar. Zimbra accepts iCalendar CANCEL and REQUEST comp…

    Zimbra Zimbra Collaboration Suite
  • Medium 5.3
    CVE-2026-93628

    Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar REPLY Attendee Response

    An attendee authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to forge another attendee's response to an existing meeting. Zimbra passes a null sender identity when processing iC…

    Zimbra Zimbra Collaboration Suite
  • Medium 5.3
    CVE-2026-93629

    Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar REQUEST Organizer Identity

    An organizer authentication vulnerability in Zimbra Collaboration Suite (ZCS) allows an unauthenticated email sender to insert calendar invitations attributed to another user. The email delivery path permits external invitations but does not verify that the m…

    Zimbra Zimbra Collaboration Suite
  • Medium 4.3
    CVE-2026-115785

    Zimbra Collaboration Suite Data Source Test SMTP Command Injection via Unsanitized Email Address

    An SMTP command injection vulnerability in the data-source testing functionality of Zimbra Collaboration Suite (ZCS) allows an ordinary authenticated user with account options enabled to inject CR/LF into the emailAddress inserted into an SMTP envelope comman…

    Zimbra Zimbra Collaboration Suite
  • Medium 4.3
    CVE-2026-93630

    Zimbra Collaboration Suite Email HTML Sanitizer Bypass via Hostname Canonicalization

    A hostname canonicalization vulnerability in the email HTML sanitizers of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to bypass the restriction on forms that target the Zimbra host. DefangFilter and the OWASP ActionAttributePolicy compar…

    Zimbra Zimbra Collaboration Suite
  • Medium 4.3
    CVE-2026-93634

    Zimbra Collaboration Suite Cross-Account Authorization Bypass via Forged Shared-File Records

    A cross-account authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to insert forged shared-file records into another user's mailbox through FileSharedWithMeRequest. The request bypasses delegated-account authorization…

    Zimbra Zimbra Collaboration Suite
  • Medium 4.3
    CVE-2026-93636

    Zimbra Collaboration Suite LDAP Filter Injection via Calendar Resource Attribute Name

    An LDAP filter injection vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to query otherwise unreturned attributes of calendar resources through SearchCalendarResourcesRequest. Zimbra escapes search values but inserts the supplie…

    Zimbra Zimbra Collaboration Suite

Revision history

  1. #1

    Initiale Fassung

References