---
id: "CVE-2026-50057"
kind: "vulnerability"
aliases: ["CVE-2026-50057"]
title: "Zimbra Collaboration Suite MTA: local zimbra user escalates to root"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "mail-server", "postfix", "self-hosted", "zimbra"]
not_affected_if: ["local-access-restricted", "no-zimbra-install"]
published_at: "2026-10-23T14:17:53+00:00"
first_seen_at: "2026-10-23T21:57:34+00:00"
updated_at: "2026-10-25T03:08:07+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50057", "first_seen_at": "2026-10-23T21:57:34+00:00"}]
---

# Zimbra Collaboration Suite MTA: local zimbra user escalates to root

A flaw in the Zimbra Collaboration Suite MTA package lets the local zimbra account run arbitrary commands as root. The installed sudo policy allows passwordless root runs of Postfix admin commands without argument limits, so an attacker can point Postfix at a zimbra-writable directory and get a root-run program.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed ZCS version (`su - zimbra -c 'zmcontrol -v'`) and compare against the affected releases `10.1.16` and `10.1.21`
- Review the sudo policy for Postfix commands (`sudo -l -U zimbra`) and look for passwordless root entries for postfix
- Confirm whether the Postfix configuration directory is writable by zimbra (`ls -ld /opt/zimbra/postfix/conf` or the path used on your install)

## Fix

- Upgrade Zimbra Collaboration Suite to a fixed release; the sources do not name the fixed version, so check the Zimbra advisory
- Until patched, restrict or remove the sudo rules that allow zimbra to run Postfix commands as root, and make the Postfix configuration directory not writable by zimbra
- Limit local shell access to the zimbra account on MTA nodes

## Timeline

- 2026-10-23T21:57:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-50057

## From the sources

A local privilege escalation vulnerability in the Zimbra Collaboration Suite (ZCS) MTA package allows the Unix zimbra account to execute arbitrary commands as root. The installed sudo policy permits passwordless root execution of Postfix administration commands without restricting their arguments. An attacker can select a zimbra-controlled daemon_directory in the Postfix configuration and invoke postfix set-permissions, causing Postfix to execute the attacker's post-install program as root. The Postfix configuration directory is also writable by zimbra, so restricting postconf alone does not remove the execution path. Exploitation requires local command execution as zimbra on an MTA node. ZCS 10.1.16 and 10.1.21 are affected.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_