Description
An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Classic recipient clicks Accept Share, allowing the attacker to access mailbox data and act as the victim.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Zimbra | Zimbra Collaboration Suite (ZCS) | < 10.1.21 | 10.1.21 |
Advisories 1
- WID-SEC-2026-3593 Synacor Zimbra: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 29, 2026
References
- https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories vendor-advisory