---
id: "CVE-2026-115786"
kind: "vulnerability"
aliases: ["CVE-2026-115786"]
title: "Zimbra: repeated document share and revoke exhausts another user's mailbox quota"
severity: "medium"
cvss: 6.5
epss: 0.00436
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["mail", "package", "self-hosted", "zimbra"]
not_affected_if: ["default-config"]
published_at: "2026-10-23T14:17:52+00:00"
first_seen_at: "2026-10-23T21:57:34+00:00"
updated_at: "2026-10-25T12:38:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115786", "first_seen_at": "2026-10-23T21:57:34+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-115786", "first_seen_at": "2026-10-25T12:38:50+00:00"}]
---

# Zimbra: repeated document share and revoke exhausts another user's mailbox quota

A logged-in Zimbra Collaboration Suite user can repeatedly share and revoke a document so that the mailbox-wide quota charge is never reversed, filling a recipient's quota. Once the quota is full, the victim cannot receive new mail or perform other size-increasing operations, without any action from the victim.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed ZCS version (for example with `su - zimbra -c "zmcontrol -v"`); the sources name 10.1.16 and 10.1.20 as affected.
- Review whether users can share documents with each other in the deployment.

## Fix

- Upgrade ZCS to a release that includes the fix; the fixed version is unknown from the sources.
- Until patched, monitor mailbox quota usage for accounts that grow without matching visible content.

## Timeline

- 2026-10-23T21:57:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115786
- 2026-10-25T12:38:50+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-115786

## From the sources

A mailbox quota-accounting vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to consume another user’s mailbox quota by repeatedly sharing and revoking a document. Creation of the recipient’s shared-file record charges the document size to mailbox-wide usage. Revocation deletes the record and reverses its folder counters without reversing the mailbox-wide charge. Repeated normal share notifications therefore accumulate quota usage after the visible records are gone. On accounts with a finite quota, this can prevent incoming mail and other size-increasing operations without recipient interaction. The issue affects ZCS 10.1.16 and 10.1.20.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_