CVE-2026-93639: Zimbra Collaboration Suite Missing Authorization in ConfigureZimlet Enables Delegated Administrator Privilege Escalation
A missing authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows a delegated administrator with no explicit administrative grants to overwrite global Zimlet configuration through ConfigureZimletRequest. The uploaded configuration can also add an attacker-controlled domain to the proxy allowlist of the default class of service. If a signed-in user in that class opens a crafted /service/proxy URL, Zimbra serves attacker-controlled HTML under its own origin. The resulting JavaScript can read mailbox data and perform authenticated actions as the victim. Exploitation requires a delegated-administrator account and access to the admin SOAP service; the browser compromise additionally requires the victim to open the crafted URL. ZCS 10.1.16 and 10.1.20 are affected.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
Exploitation requires a delegated-administrator account, even one with no explicit administrative grants, and access to the Zimbra admin SOAP service. The attacker can use ConfigureZimletRequest to overwrite global Zimlet configuration.
Which users are at risk of mailbox compromise?
Signed-in users assigned to the default class of service are at risk if the attacker adds an attacker-controlled domain to that class's proxy allowlist. The victim must open an attacker-crafted /service/proxy URL for attacker-controlled HTML and JavaScript to run under the Zimbra origin.
How can teams determine whether they may be affected?
Zimbra Collaboration Suite versions 10.1.16 and 10.1.20 are identified as affected. Review whether delegated-administrator accounts can access the admin SOAP service and inspect global Zimlet configuration and the default class-of-service proxy allowlist for unauthorized changes.