CVE-2026-93634: Zimbra Collaboration Suite Cross-Account Authorization Bypass via Forged Shared-File Records
A cross-account authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to insert forged shared-file records into another user's mailbox through FileSharedWithMeRequest. The request bypasses delegated-account authorization and accepts attacker-selected file metadata, owner identifiers and declared sizes without validating a corresponding document share. An attacker can plant entries attributed to another real local account without that account sharing a document. No victim interaction is required. ZCS 10.1.16 and 10.1.20 are affected.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Zimbra Collaboration Suite user can exploit it. The attacker does not need delegated-account authorization or any interaction from the target user.
What can an attacker do with the bypass?
The attacker can insert forged shared-file records into another user's mailbox and attribute them to a real local account. The forged records can contain attacker-selected file metadata, owner identifiers, and declared file sizes without a corresponding document share.
Which Zimbra versions are identified as affected?
Zimbra Collaboration Suite 10.1.16 and 10.1.20 are affected.