{"id":"CVE-2026-115786","kind":"vulnerability","aliases":["CVE-2026-115786"],"related":[],"title":"Zimbra: repeated document share and revoke exhausts another user's mailbox quota","description":"A mailbox quota-accounting vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to consume another user’s mailbox quota by repeatedly sharing and revoking a document. Creation of the recipient’s shared-file record charges the document size to mailbox-wide usage. Revocation deletes the record and reverses its folder counters without reversing the mailbox-wide charge. Repeated normal share notifications therefore accumulate quota usage after the visible records are gone. On accounts with a finite quota, this can prevent incoming mail and other size-increasing operations without recipient interaction. The issue affects ZCS 10.1.16 and 10.1.20.","summary":"A logged-in Zimbra Collaboration Suite user can repeatedly share and revoke a document so that the mailbox-wide quota charge is never reversed, filling a recipient's quota. Once the quota is full, the victim cannot receive new mail or perform other size-increasing operations, without any action from the victim.","severity":"medium","cvss":6.5,"epss":0.00436,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mail","package","self-hosted","zimbra"],"not_affected_if":["default-config"],"how_to_check":"- Check the installed ZCS version (for example with `su - zimbra -c \"zmcontrol -v\"`); the sources name 10.1.16 and 10.1.20 as affected.\n- Review whether users can share documents with each other in the deployment.","fix":"- Upgrade ZCS to a release that includes the fix; the fixed version is unknown from the sources.\n- Until patched, monitor mailbox quota usage for accounts that grow without matching visible content.","status":"open","published_at":"2026-10-23T14:17:52+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-25T03:47:16+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:47:16Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade ZCS to a release that includes the fix; the fixed version is unknown from the sources.\n- Until patched, monitor mailbox quota usage for accounts that grow without matching visible content.","reach":"network","title":"Zimbra: repeated document share and revoke exhausts another user's mailbox quota","impact":"medium","summary":"A logged-in Zimbra Collaboration Suite user can repeatedly share and revoke a document so that the mailbox-wide quota charge is never reversed, filling a recipient's quota. Once the quota is full, the victim cannot receive new mail or perform other size-increasing operations, without any action from the victim.","category":"package","nicknames":[],"who_cares":["zimbra","self-hosted","mail"],"confidence":0.6,"needs_auth":"yes","worst_case":"Victim's mailbox quota filled, blocking incoming mail","analyst_note":"Check the Zimbra security advisory and NVD entry for the fixed version and whether the flaw requires a specific sharing feature to be enabled.","how_to_check":"- Check the installed ZCS version (for example with `su - zimbra -c \"zmcontrol -v\"`); the sources name 10.1.16 and 10.1.20 as affected.\n- Review whether users can share documents with each other in the deployment.","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Zimbra Collaboration Suite deployments on the affected versions where accounts have finite quotas and users can share documents with each other. Deployments on other versions, or with unlimited quotas, are less exposed; the sources do not say whether the fix is in a specific build.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000649,"input_tokens":3457,"output_tokens":607,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115786':15A,18A '-2026':14A,17A '10.1.16':181C '10.1.20':183C 'account':84C,158C 'accumul':148C 'action':76B 'affect':179C 'allow':91C 'anoth':8A,97C 'authent':93C 'cannot':63B 'charg':47B,118C,142C 'collabor':30B,88C 'consum':96C 'counter':135C 'creation':109C 'cve':13A,16A 'delet':128C 'document':3A,39B,108C,120C 'exhaust':7A 'file':116C 'fill':51B 'finit':161C 'folder':134C 'full':60B 'gone':156C 'host':23B 'incom':166C 'increas':72B,172C 'interact':176C 'issu':178C 'log':27B 'logged-in':26B 'mail':19B,66B,167C 'mailbox':11A,44B,81C,100C,124C,140C 'mailbox-wid':43B,123C,139C 'never':49B 'new':65B 'normal':144C 'notif':146C 'oper':73B,173C 'packag':20B 'perform':68B 'prevent':165C 'quota':12A,46B,55B,58B,83C,101C,149C,162C 'quota-account':82C 'receiv':64B 'recipi':53B,112C,175C 'record':117C,130C,154C 'repeat':2A,34B,103C,143C 'revers':50B,132C,137C 'revoc':127C 'revok':6A,37B,106C 'self':22B 'self-host':21B 'share':4A,35B,104C,115C,145C 'shared-fil':114C 'size':71B,121C,171C 'size-increas':70B,170C 'suit':31B,89C 'therefor':147C 'usag':126C,150C 'user':9A,32B,94C,98C 'victim':62B,79B 'visibl':153C 'vulner':85C 'wide':45B,125C,141C 'without':74B,136C,174C 'zcs':90C,180C 'zimbra':1A,24B,29B,87C","nicknames":[],"mitigations":[],"who_affected":"Zimbra Collaboration Suite deployments on the affected versions where accounts have finite quotas and users can share documents with each other. Deployments on other versions, or with unlimited quotas, are less exposed; the sources do not say whether the fix is in a specific build.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T14:17:52+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvss_by":"cve@rapid7.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115786","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115786","severity":null,"published_at":"2026-10-23T14:17:52+00:00","modified_at":"2026-10-23T16:44:17+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-115786","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115786","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}