IP-DB.com
Türkçe English Deutsch Español
Anmelden API-Schlüssel holen
6.5Mittel

CVE-2026-10631Zimbra Collaboration Suite EWS Extension Authorization Bypass via Crafted Composite Folder/Item Identifier

Zimbra Zimbra Collaboration Suite Veröffentlicht: (vor 1 Monat)

Beschreibung

An authorization bypass in the EWS FindItem handler of Zimbra Collaboration Suite 10.1.0 through 10.1.19 allows an authenticated user with EWS enabled to read complete mailbox items, including raw MIME and attachments, from arbitrary local accounts without a share or delegation grant.

Schwachstellentyp (CWE): CWE-639

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

HerstellerProduktVersionen
Zimbra Zimbra Collaboration Suite < 10.1.20

Referenzen und Patches

Neue CVEs im selben Produkt — Zimbra Collaboration

5.3Mittel
CVE-2026-66912

Stored Cross-Site Scripting in Zimbra

Synacor Zimbra Collaboration

Zimbra is vulnerable to Stored Cross-Site Scripting (XSS) via the From email header during HTML reply composition in Classic UI. Due to insufficient sanitization of the From header value, a remote attacker can send a crafted email containing a malicious From …

5.3Mittel
CVE-2026-66911

Stored Cross-Site Scripting in Zimbra

Synacor Zimbra Collaboration

Zimbra is vulnerable to stored cross-site scripting (XSS) via the Content-Location MIME header in email attachments. Due to lack of sanitization of the Content-Location header, an attacker can set it to a javascript: URI. An unauthenticated remote attacker ca…