Zimbra Collaboration Suite EUVD-2026-95097

Exploitation requires the attacker to already control an authenticated Zimbra Collaboration Suite account (PR:L) and to invoke the GrantRightsRequest SOAP/admin operation targeting the loginAs right on a local account. The limiting factor is this pre-existing authenticated access - there is no unauthenticated path and no user interaction (UI:N) is needed from a victim. The distinguishing, risk-amplifying condition is persistence: once the loginAs grant is created it is a durable delegation that is not revoked by the victim's password change or session expiry, so remediation requires explicitly auditing and removing granted rights rather than just resetting credentials. No non-default feature toggle is named in the description; the flaw is in the standard rights-granting path.

This is a moderate-priority issue that requires calibration against raw CVSS. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, base 7.1) confirms network-reachable, low-complexity exploitation but explicitly requires existing authenticated access (PR:L) - so this is not a pre-auth breach but a post-compromise privilege/persistence mechanism. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The vulnerability is NOT listed in CISA KEV and no public exploit code was supplied, yielding an exploitation status of 'no public exploit identified at time of analysis'; there is therefore no evidence of active or widespread exploitation. The CWE-269 (improper privilege management) classification is consistent with the described GrantRightsRequest/loginAs abuse. The most security-relevant signal is not the score but the persistence property: the granted loginAs right survives password resets and session expiry, which defeats the most common incident-response containment step and elevates post-breach risk beyond what the 7.1 suggests. Signals are internally consistent (authenticated network vector matches 'attacker with access to an authenticated account'); the main gap is the absence of EPSS, KEV, and POC data, meaning real-world exploitation likelihood is currently unmeasured rather than confirmed low.

An attacker who has already obtained credentials or an active session for any low-privileged Zimbra account (via phishing, credential stuffing, or a prior compromise) issues a crafted GrantRightsRequest to grant the loginAs right over a target mailbox to an attacker-controlled local account. Because the authorization check is flawed, the grant succeeds without legitimate administrative rights, giving durable read and send access to the victim's mailbox. No public exploit code is identified at this time, and exploitation requires an existing authenticated account (PR:L), so this is a persistence/lateral-access play rather than an initial-access vulnerability.