Zimbra Collaboration Suite CVE-2026-10631

Exploitation requires (1) a valid authenticated Zimbra account of any privilege level on the target server (PR:L), and (2) the EWS (Exchange Web Services) interface being enabled on that server - the description explicitly scopes the flaw to 'an authenticated user with EWS enabled.' The affected deployment must run Zimbra Collaboration Suite 10.1.0 through 10.1.19. Limiting factors that reduce real-world risk: credentials are mandatory (no anonymous/unauthenticated path), EWS must be turned on (deployments that disable the EWS connector are not exposed), and the impact is read-only data disclosure with no integrity or availability effect. The highest-risk configurations are multi-tenant or large-org servers where a single low-privilege account yields access to many other mailboxes.

This is a genuine but moderate-priority issue rather than a drop-everything emergency. The provided CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) is internally consistent with the description: network-reachable, low attack complexity, and - critically - PR:L, meaning a valid authenticated account is required, which caps severity at Medium despite the High confidentiality impact (full mailbox read including raw MIME and attachments). No EPSS score, CISA KEV entry, or public POC was supplied in the intelligence set, so there is no positive signal of active exploitation or weaponization at this time. The weakness class is CWE-639 (authorization bypass through user-controlled key), which matches the described EWS FindItem handler flaw and contradicts the input tag 'Authentication Bypass' - this is an authorization (not authentication) bypass, since the attacker is already authenticated. The confidentiality-only impact (I:N/A:N) means data exposure, not tampering or disruption. Bottom line: the pre-condition of a valid account plus EWS being enabled makes this a targeted/insider or post-compromise data-theft risk rather than a wormable mass-exploitation threat, but in multi-tenant Zimbra deployments (hosting providers, governments, universities) the cross-account mailbox read is severe and warrants prompt patching. Missing data: no EPSS, no KEV, no confirmed patched version, and no POC status - these should be verified against the Zimbra Security Advisories page before final prioritization.

An attacker who holds (or phishes/purchases) any low-privileged mailbox account on a Zimbra 10.1.x server with EWS enabled sends a crafted EWS FindItem request referencing another user's mailbox identifier. The server fails to enforce share/delegation authorization and returns the victim's complete mail items, including raw MIME bodies and attachments, enabling silent bulk harvesting of executive or cross-tenant correspondence. No public exploit was identified in the provided data, so exploitation currently requires the attacker to develop the request independently.