CVE-2026-115786: Zimbra Collaboration Suite Shared-File Mailbox Quota Accounting Error Enables Quota Exhaustion
A mailbox quota-accounting vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to consume another user’s mailbox quota by repeatedly sharing and revoking a document. Creation of the recipient’s shared-file record charges the document size to mailbox-wide usage. Revocation deletes the record and reverses its folder counters without reversing the mailbox-wide charge. Repeated normal share notifications therefore accumulate quota usage after the visible records are gone. On accounts with a finite quota, this can prevent incoming mail and other size-increasing operations without recipient interaction. The issue affects ZCS 10.1.16 and 10.1.20.
Affected Software
Event History
Frequently Asked Questions
Which accounts are exposed to quota exhaustion?
Accounts with a finite mailbox quota are exposed if an authenticated user can repeatedly share and revoke a document with them. The recipient does not need to interact with the share notifications.
What access does an attacker need?
An attacker needs authenticated access as a ZCS user. Exploitation uses normal document sharing and revocation actions and does not require recipient interaction.
What operational impact indicates exploitation may be occurring?
A recipient's mailbox-wide usage can continue increasing even after the shared-file records have been revoked and are no longer visible. Once the finite quota is exhausted, incoming mail and other operations that increase mailbox size can be blocked.
Which ZCS versions are identified as affected?
The issue affects Zimbra Collaboration Suite 10.1.16 and 10.1.20.