EUVD-2026-58070
GHSA-p856-mgqw-j9rq
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Network-reachable SOAP API requires authenticated low-privilege account and non-trivial payload crafting (AC:H); impact confined to integrity via unauthorized email impersonation only.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
An authorization bypass vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.17 due to improper authorization validation in delegated email sending functionality. An authenticated attacker can send specially crafted SOAP requests to impersonate another user and send emails without possessing the required delegation or send-as permissions. This occurs in the
SaveDraftRequest SOAP handler.
AnalysisAI
Authorization bypass in Zimbra Collaboration (ZCS) before 10.1.17 allows authenticated users to impersonate other accounts and send emails by exploiting improper permission validation in the SaveDraftRequest SOAP handler. An attacker with a valid low-privilege account can craft SOAP requests that circumvent delegation and send-as permission checks, enabling unauthorized email impersonation without possessing the required access grants. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated Zimbra Collaboration account with at minimum low-privilege access (PR:L per CVSS vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N indicates a network-reachable flaw requiring an authenticated (low-privilege) account and high attack complexity, with scope unchanged and impact limited solely to integrity (no confidentiality or availability consequence). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a valid but low-privilege Zimbra account crafts a specially constructed SaveDraftRequest SOAP API call that specifies a target user's identity in the sender field without holding delegation or send-as permissions for that account. Because the authorization check is improperly implemented, the server processes the request and dispatches the email appearing to originate from the impersonated user. … |
| Remediation | Upgrade Zimbra Collaboration to version 10.1.17 or later, which is confirmed as the first patched release per EUVD-2026-58070 and vendor advisory data available at https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Collaboration
View allRemote code execution in Zimbra Collaboration (ZCS) before 10.1.20 enables unauthenticated network attackers to execute
Zimbra's sudo configuration permits the zimbra user to execute the zmslapd binary as root with arbitrary parameters. Rat
An issue was discovered in ProxyServlet.java in the /proxy servlet in Zimbra Collaboration Suite 8.8 before 8.8.15 Patch
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.x and 9.x (e.g., 8.8.15). Rated high severity (CVSS 7.8), this
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. Rated medium severity (CVSS 6.1), this vulnerability
An issue in Zimbra Collaboration ZCS v.8.8.15 and v.9.0 allows an attacker to execute arbitrary code via the sfdc_preaut
An issue in Zimbra Collaboration (ZCS) v.8.8.15 and v.9.0 allows a remote attacker to escalate privileges and obtain sen
Zimbra Collaboration Open Source 8.8.15 does not encrypt the initial-login randomly created password (from the "zmprove
An issue was discovered in ZmMailMsgView.js in the Calendar Invite component in Zimbra Collaboration Suite 8.8.x before
An issue was discovered in Zimbra Collaboration (ZCS) 10.1.x before 10.1.1, 10.0.x before 10.0.9, 9.0.0 before Patch 41,
File Upload vulnerability in Zimbra ZCS 8.8.15 allows an authenticated privileged user to execute arbitrary code and obt
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. Rated high severity (CVSS 7.8), this vulnerability i
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today