Live › vulnerability › CVE-2026-93627
Go to dashboardZimbra Collaboration Suite accepts iCalendar CANCEL and REQUEST messages without checking that the sender is the stated meeting organizer. An unauthenticated sender who knows a meeting UID and organizer address can move the recipient's meeting to Trash or overwrite its details.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Organizations running Zimbra Collaboration Suite versions 10.1.16 and 10.1.21, where incoming email with calendar invitations is processed automatically. Deployments on other versions are not named in the sources, and the sources do not say whether the flaw needs any non-default setting.
No product ranges from the sources yet.
su - zimbra -c "zmcontrol -v") and compare it with the affected releases 10.1.16 and 10.1.21.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An organizer authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to cancel or modify an existing meeting in a recipient's calendar. Zimbra accepts iCalendar CANCEL and REQUEST components without verifying that the email sender is authorized to act as the supplied organizer. An attacker who knows the meeting UID and organizer address can supply a non-outdated sequence number to move the recipient's meeting to Trash or replace its details. Processing occurs automatically during email delivery without recipient interaction. ZCS 10.1.16 and 10.1.21 are affected.
This page as .md · .json · in your agent: get_signal("CVE-2026-93627")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.