CVE-2026-10631: Zimbra Collaboration Suite EWS Extension Authorization Bypass via Crafted Composite Folder/Item Identifier
An authorization bypass in the EWS FindItem handler of Zimbra Collaboration Suite 10.1.0 through 10.1.19 allows an authenticated user with EWS enabled to read complete mailbox items, including raw MIME and attachments, from arbitrary local accounts without a share or delegation grant.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Zimbra user can exploit it if EWS is enabled for that user. The affected handler can expose mailbox items from arbitrary local accounts without a share or delegation grant.
What data could be exposed?
The issue allows reading complete mailbox items, including raw MIME content and attachments. The provided data does not indicate any integrity or availability impact.
Which deployments are identified as affected?
Zimbra Collaboration Suite versions 10.1.0 through 10.1.19 are identified as affected. The description specifically requires EWS to be enabled for the attacking account.