Zimbra Collaboration Suite EUVD-2026-109080

Requires a valid authenticated account on the same Zimbra Collaboration Suite instance (PR:L) and use of the document file-sharing feature, which charges document size to mailbox-wide usage on share-record creation but fails to reverse that mailbox-wide charge on revocation. The victim account must have a finite (non-unlimited) mailbox quota for the attack to deny service; no victim interaction is needed (UI:N). Limiting factors: the attacker needs a provisioned low-privileged account rather than anonymous access, impact is confined to availability (no data read or modification), and accounts configured with unlimited quota are unaffected. Confirmed affected: ZCS 10.1.16 and 10.1.20; no fixed version is provided in the available evidence.

This is a moderate-severity availability issue, not a top-tier emergency. The supplied CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 6.5) is internally consistent with the description: a network-reachable, low-complexity attack requiring a valid low-privileged account (PR:L), no victim interaction (UI:N), and impact limited purely to availability (C:N/I:N/A:H) via mailbox quota exhaustion. The vuln.today decision label is 'this_month' rather than act_now/emergency, consistent with a privileged-but-unauthenticated-to-the-victim denial-of-service that cannot leak or alter data. No EPSS score was provided, no CISA KEV listing is present (not actively exploited per available data), and no confirmed working exploit code is indicated - only a Rapid7 research write-up reference exists. The one notable data conflict: the input Tags label this 'Information Disclosure,' which directly contradicts the CVSS vector (C:N) and the description - this is an availability/quota-accounting flaw (CWE-682 Incorrect Calculation), so the tag appears mislabeled and should not drive triage. Net: a credible, low-complexity DoS against individual mailboxes that warrants scheduled patching, not crisis response.

An authenticated low-privileged Zimbra user repeatedly shares a document with a victim and then revokes it; each share charges the document size to the victim's mailbox-wide quota usage, but revocation never reverses that mailbox-wide charge. By looping normal share/revoke notifications, the attacker silently inflates the victim's quota until it is full, blocking incoming mail and other size-increasing operations without any victim interaction. A Rapid7 research write-up describing the Zimbra identity-boundary issues is publicly referenced, but the input does not confirm it as working exploit code.