CVE-2025-32354: CSRF
In Zimbra Collaboration (ZCS) 9.0 through 10.1, a Cross-Site Request Forgery (CSRF) vulnerability exists in the GraphQL endpoint (/service/extension/graphql) of Zimbra webmail due to a lack of CSRF token validation. This allows attackers to perform unauthorized GraphQL operations, such as modifying contacts, changing account settings, and accessing sensitive user data when an authenticated user visits a malicious website.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-32354?
CVE-2025-32354 has been classified as a medium severity Cross-Site Request Forgery (CSRF) vulnerability.
How do I fix CVE-2025-32354?
To fix CVE-2025-32354, ensure you are using the latest version of Zimbra Collaboration that addresses the CSRF vulnerability.
What versions of Zimbra are affected by CVE-2025-32354?
CVE-2025-32354 affects Zimbra Collaboration Suite (ZCS) versions from 9.0 to 10.1.
What type of attack does CVE-2025-32354 allow?
CVE-2025-32354 allows attackers to perform unauthorized GraphQL operations on the Zimbra webmail due to a lack of CSRF token validation.
Is user authentication affected by CVE-2025-32354?
CVE-2025-32354 does not directly affect user authentication, but it allows unauthorized actions that could compromise user accounts.