---
id: "CVE-2026-50053"
kind: "vulnerability"
aliases: ["CVE-2026-50053"]
title: "Zimbra Collaboration Suite: unauthenticated request override enables cross-user script execution"
severity: "high"
cvss: 8.7
epss: 0.00424
exploited: false
status: "open"
category: "package"
products: [{"name": "Zimbra Collaboration Suite", "fixed": [], "affected": "<= 10.1.17 (CVE record; XSS chain exploitable on 10.1.16 and earlier)", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["classic-web-client", "mail-server", "package", "self-hosted", "xss", "zimbra"]
not_affected_if: ["managed-hosting"]
published_at: "2026-10-23T14:17:53+00:00"
first_seen_at: "2026-10-23T21:57:34+00:00"
updated_at: "2026-10-25T12:38:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50053", "first_seen_at": "2026-10-23T21:57:34+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:35:32+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-50053", "first_seen_at": "2026-10-25T12:38:49+00:00"}]
---

# Zimbra Collaboration Suite: unauthenticated request override enables cross-user script execution

RestFilter in Zimbra Collaboration Suite lets unauthenticated requests to /h/* set internal servlet attributes (auth token, target account, item, dispatch state). With CVE-2026-10632 (reflected XSS in the /h/rest document editor, ZCS 10.1.16) a user with any ordinary account can run JavaScript in another signed-in user's session when they open a crafted URL. That can read mailbox data and act as the victim. CVSS 8.7. The override primitive itself is still present in 10.1.17.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Zimbra Collaboration Suite affected <= 10.1.17 (CVE record; XSS chain exploitable on 10.1.16 and earlier) fixed ?

## How to check

Find your version with 'zmcontrol -v' as the zimbra user. 10.1.16 or earlier is exposed to the full chain. 10.1.17 and later is not exposed to this XSS chain but still has the override. Only the Classic Web Client (/h/*) is involved, so also check whether it is reachable, e.g. a request to https://<host>/h/ .

## Fix

Upgrade to ZCS 10.1.17 or later (10.1.21 is the newest release I saw). This breaks the XSS chain only. No vendor fix for the override itself or config workaround is documented. Until upgraded, consider blocking /h/* at the proxy if the Classic Web Client is not needed (my suggestion, not from the vendor).

## Timeline

- 2026-10-23T21:57:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-50053
- 2026-10-23T23:35:32+00:00 analyst — Read CVE records for 50053 and 10632 plus Zimbra 10.1.17 release page. 50053 CNA lists affected 0 through 10.1.17 with no fixed version; 10.1.17 only breaks the XSS chain (CVE-2026-10632, affects 10.1.16, fixed 10.1.17). The 10.1.17 release page snippet I read did not list 10632 by id. No Zimbra advisory for 50053 found, no exploitation or PoC found, social not searched. Whether a later release (10.1.21 exists) removes the override is unknown.
- 2026-10-25T12:38:49+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-50053

## Documents

- [advisory] CVE Record: CVE-2026-50053 https://www.cve.org/CVERecord?id=CVE-2026-50053
- [describes] CVE Record: CVE-2026-10632 (XSS half of the chain) https://www.cve.org/CVERecord?id=CVE-2026-10632
- [fix] Zimbra 10.1.17 release notes https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.17

## From the sources

A request attribute override vulnerability in Zimbra Collaboration Suite (ZCS) allows unauthenticated requests to /h/* to populate servlet attributes intended for trusted internal dispatch. RestFilter copies URL parameters specifying an authentication token, target account, target item and dispatch state into the request attributes consumed by the Classic Web Client. Combined with CVE-2026-10632 on ZCS 10.1.16, this allows an attacker to supply their own valid token and document identifiers and execute JavaScript in another user's signed-in browser session. ZCS 10.1.17 blocks that XSS chain by changing the document renderer, but retains the request attribute override.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_