Zimbra Collaboration Suite EUVD-2026-108974

The attacker must hold a valid authenticated account on the target Zimbra server (PR:L) - any local user suffices, no admin or delegated rights are needed because the flaw is precisely that FileSharedWithMeRequest bypasses delegated-account authorization. The request accepts attacker-selected file metadata, owner identifiers and declared sizes without validating a corresponding real document share, so no cooperation from the victim and no prior share are required. Limiting factors: exploitation is confined to authenticated users of the server, requires no victim interaction, and its impact is limited to integrity (planting forged 'shared with me' records attributed to another real local account) with no confidentiality or availability effect; affected versions are ZCS 10.1.16 and 10.1.20.

This is a genuinely low-urgency, medium-severity issue despite being remotely reachable. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base 4.3) is internally consistent with the description: an already-authenticated user (PR:L) can abuse FileSharedWithMeRequest over the network with low complexity and no victim interaction, but the only impact is low integrity (I:L) - forged shared-file records planted in another account - with no confidentiality or availability loss. The vuln.today Decision label is 'this_month' (not act_now/emergency), which aligns with the modest CVSS and integrity-only impact. No EPSS score was provided and the CVE is not listed in CISA KEV, so there is no signal of widespread or automated exploitation. The SSVC decision inputs (automatable, technical impact, exploitation status) were not supplied and cannot be assessed. A public technical reference from Rapid7 exists (the original reporter), which raises the odds of exploit development, but this is an authenticated, integrity-limited data-forgery flaw rather than a code-execution or data-theft bug. Note that Zimbra as a product has a strong history of being targeted, so operators should not dismiss it, but on its own signals this flaw is a routine scheduled-patch item, not a drop-everything priority.

An attacker who already holds a valid, low-privileged account on the Zimbra server sends a crafted FileSharedWithMeRequest specifying another real local user as the file owner and attacker-chosen file metadata. Because the request bypasses delegated-account authorization and does not validate a corresponding document share, a forged 'shared with me' entry appears in the victim's mailbox with no action or interaction by the victim, enabling spoofing or social-engineering follow-ons. A public technical reference from Rapid7 exists; it is not verified as working exploit code.