Zimbra Collaboration Suite EUVD-2026-95098

Requires a valid authenticated mailbox account on the Zimbra server (PR:L) and an environment where the administrator has explicitly DISABLED mail forwarding as a policy control - the vulnerability lets the user defeat that specific restriction. The concrete prerequisite is the ability to create a Sieve filter using the 'notify' action; exploitation hinges on Sieve filtering being available to the user. Limiting factors: it is not exploitable by unauthenticated/anonymous attackers, it yields confidentiality impact only (no integrity or availability effect), and it is primarily meaningful in deployments that rely on disabled-forwarding as a data-loss-prevention control rather than default installs that permit forwarding anyway.

This is a moderate-risk authorization flaw, not a critical pre-auth RCE. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) is internally consistent with the description: exploitation is network-reachable and low-complexity but requires an already-authenticated low-privilege mailbox user (PR:L), and the impact is confidentiality-only (C:H, I:N, A:N) - matching a data-exfiltration/policy-bypass issue rather than system compromise. CWE-863 (improper authorization) correctly characterizes it as a policy-enforcement bypass rather than a true authentication bypass. No EPSS score, no CISA KEV listing, and no public POC were supplied in the intelligence, so there is no public exploit identified at time of analysis; the absence of these signals suggests this is a priority driven by impact-to-specific-tenants (email confidentiality / insider or compromised-account exfiltration) rather than mass internet-scale exploitation. The 'Authentication Bypass' tag conflicts with the description, which explicitly says the actor is an authenticated user - this is an authorization/policy bypass, which should be reconciled before downstream triage. Net: real but targeted concern for multi-tenant and privacy-sensitive Zimbra deployments, not an emergency-patch-everywhere issue absent exploitation evidence.

An authenticated Zimbra user whose administrator has disabled mail forwarding configures a Sieve filter with a notify action pointing at an attacker-controlled external address, causing copies of incoming email content and headers to be silently exfiltrated despite the forwarding restriction. This is especially relevant for a malicious insider or an account that has been phished/compromised. No public exploit code was identified at time of analysis, and the low attack complexity (AC:L) means the Sieve rule is straightforward to craft once a user is logged in.