{"id":"CVE-2026-50057","kind":"vulnerability","aliases":["CVE-2026-50057"],"related":[],"title":"Zimbra Collaboration Suite MTA: local zimbra user escalates to root","description":"A local privilege escalation vulnerability in the Zimbra Collaboration Suite (ZCS) MTA package allows the Unix zimbra account to execute arbitrary commands as root. The installed sudo policy permits passwordless root execution of Postfix administration commands without restricting their arguments. An attacker can select a zimbra-controlled daemon_directory in the Postfix configuration and invoke postfix set-permissions, causing Postfix to execute the attacker's post-install program as root. The Postfix configuration directory is also writable by zimbra, so restricting postconf alone does not remove the execution path. Exploitation requires local command execution as zimbra on an MTA node. ZCS 10.1.16 and 10.1.21 are affected.","summary":"A flaw in the Zimbra Collaboration Suite MTA package lets the local zimbra account run arbitrary commands as root. The installed sudo policy allows passwordless root runs of Postfix admin commands without argument limits, so an attacker can point Postfix at a zimbra-writable directory and get a root-run program.","severity":"high","cvss":7.8,"epss":0.00169,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","mail-server","postfix","self-hosted","zimbra"],"not_affected_if":["local-access-restricted","no-zimbra-install"],"how_to_check":"- Check the installed ZCS version (`su - zimbra -c 'zmcontrol -v'`) and compare against the affected releases `10.1.16` and `10.1.21`\n- Review the sudo policy for Postfix commands (`sudo -l -U zimbra`) and look for passwordless root entries for postfix\n- Confirm whether the Postfix configuration directory is writable by zimbra (`ls -ld /opt/zimbra/postfix/conf` or the path used on your install)","fix":"- Upgrade Zimbra Collaboration Suite to a fixed release; the sources do not name the fixed version, so check the Zimbra advisory\n- Until patched, restrict or remove the sudo rules that allow zimbra to run Postfix commands as root, and make the Postfix configuration directory not writable by zimbra\n- Limit local shell access to the zimbra account on MTA nodes","status":"open","published_at":"2026-10-23T14:17:53+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-25T03:08:07+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-25T03:08:07Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Zimbra Collaboration Suite to a fixed release; the sources do not name the fixed version, so check the Zimbra advisory\n- Until patched, restrict or remove the sudo rules that allow zimbra to run Postfix commands as root, and make the Postfix configuration directory not writable by zimbra\n- Limit local shell access to the zimbra account on MTA nodes","reach":"local","title":"Zimbra Collaboration Suite MTA: local zimbra user escalates to root","impact":"high","summary":"A flaw in the Zimbra Collaboration Suite MTA package lets the local zimbra account run arbitrary commands as root. The installed sudo policy allows passwordless root runs of Postfix admin commands without argument limits, so an attacker can point Postfix at a zimbra-writable directory and get a root-run program.","category":"infrastructure","nicknames":[],"who_cares":["zimbra","self-hosted","mail-server","postfix"],"confidence":0.8,"needs_auth":"yes","worst_case":"Local zimbra user gains root and runs arbitrary commands on the MTA host","analyst_note":"Confirm the fixed Zimbra version and the official patch or advisory, which the NVD entry alone does not name.","how_to_check":"- Check the installed ZCS version (`su - zimbra -c 'zmcontrol -v'`) and compare against the affected releases `10.1.16` and `10.1.21`\n- Review the sudo policy for Postfix commands (`sudo -l -U zimbra`) and look for passwordless root entries for postfix\n- Confirm whether the Postfix configuration directory is writable by zimbra (`ls -ld /opt/zimbra/postfix/conf` or the path used on your install)","needs_analyst":true,"not_affected_if":["no-zimbra-install","local-access-restricted"],"who_is_affected":"Zimbra Collaboration Suite installs running the MTA package on versions 10.1.16 and 10.1.21 are affected, based on the sources. Exploitation needs local command execution as the zimbra user, so the exposure is mainly on multi-user hosts or after another compromise. Hosts without ZCS or without the MTA package can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000746,"input_tokens":3469,"output_tokens":798,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-50057':13A,16A '10.1.16':183C '10.1.21':185C 'account':39B,96C 'admin':55B 'administr':113C 'affect':187C 'allow':49B,92C 'alon':164C 'also':157C 'arbitrari':41B,99C 'argument':58B,118C 'attack':62B,120C,144C 'caus':139C 'collabor':2A,31B,87C 'command':42B,56B,100C,114C,174C 'configur':132C,154C 'control':126C 'cve':11A,14A 'daemon':127C 'directori':71B,128C,155C 'escal':8A,82C 'execut':98C,110C,142C,169C,175C 'exploit':171C 'flaw':27B 'get':73B 'host':24B 'infrastructur':17B 'instal':46B,104C,148C 'invok':134C 'let':35B 'limit':59B 'local':5A,37B,80C,173C 'mail':19B 'mail-serv':18B 'mta':4A,33B,90C,180C 'node':181C 'packag':34B,91C 'passwordless':50B,108C 'path':170C 'permiss':138C 'permit':107C 'point':64B 'polici':48B,106C 'post':147C 'post-instal':146C 'postconf':163C 'postfix':21B,54B,65B,112C,131C,135C,140C,153C 'privileg':81C 'program':78B,149C 'remov':167C 'requir':172C 'restrict':116C,162C 'root':10A,44B,51B,76B,102C,109C,151C 'root-run':75B 'run':40B,52B,77B 'select':122C 'self':23B 'self-host':22B 'server':20B 'set':137C 'set-permiss':136C 'sudo':47B,105C 'suit':3A,32B,88C 'unix':94C 'user':7A 'vulner':83C 'without':57B,115C 'writabl':70B,158C 'zcs':89C,182C 'zimbra':1A,6A,25B,30B,38B,69B,86C,95C,125C,160C,177C 'zimbra-control':124C 'zimbra-writ':68B","nicknames":[],"mitigations":[],"who_affected":"Zimbra Collaboration Suite installs running the MTA package on versions 10.1.16 and 10.1.21 are affected, based on the sources. Exploitation needs local command execution as the zimbra user, so the exposure is mainly on multi-user hosts or after another compromise. Hosts without ZCS or without the MTA package can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T14:17:53+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"cve@rapid7.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-50057","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50057","severity":null,"published_at":"2026-10-23T14:17:53+00:00","modified_at":"2026-10-23T16:44:17+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-50057","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-50057","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}