CVE-2026-73571: Medium severity Zimbra Zimbra Collaboration (ZCS) vulnerability
An authorization bypass vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.17 due to improper authorization validation in delegated email sending functionality. An authenticated attacker can send specially crafted SOAP requests to impersonate another user and send emails without possessing the required delegation or send-as permissions. This occurs in the SaveDraftRequest SOAP handler.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73571?
The severity of CVE-2026-73571 is classified as low with a score of 3.1.
How do I fix CVE-2026-73571?
To fix CVE-2026-73571, upgrade Zimbra Collaboration to version 10.1.17 or later.
What type of vulnerability is CVE-2026-73571?
CVE-2026-73571 is an authorization bypass vulnerability affecting delegated email sending functionality in Zimbra.
Who is affected by CVE-2026-73571?
Authenticated users of Zimbra Collaboration prior to version 10.1.17 are affected by CVE-2026-73571.
What can an attacker do with CVE-2026-73571?
An attacker can send specially crafted SOAP requests to impersonate another user and send emails without authorization.