{"id":"CVE-2026-93627","kind":"vulnerability","aliases":["CVE-2026-93627"],"related":[],"title":"Zimbra Collaboration: forged calendar emails can cancel or alter recipients' meetings","description":"An organizer authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to cancel or modify an existing meeting in a recipient's calendar. Zimbra accepts iCalendar CANCEL and REQUEST components without verifying that the email sender is authorized to act as the supplied organizer. An attacker who knows the meeting UID and organizer address can supply a non-outdated sequence number to move the recipient's meeting to Trash or replace its details. Processing occurs automatically during email delivery without recipient interaction. ZCS 10.1.16 and 10.1.21 are affected.","summary":"Zimbra Collaboration Suite accepts iCalendar CANCEL and REQUEST messages without checking that the sender is the stated meeting organizer. An unauthenticated sender who knows a meeting UID and organizer address can move the recipient's meeting to Trash or overwrite its details.","severity":"medium","cvss":5.3,"epss":0.00376,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["calendar","email","infrastructure","self-hosted","zimbra"],"not_affected_if":["other-versions"],"how_to_check":"- Check the installed Zimbra version (`su - zimbra -c \"zmcontrol -v\"`) and compare it with the affected releases `10.1.16` and `10.1.21`.","fix":"- Move Zimbra Collaboration Suite to a fixed release; the sources do not name the fixed version, so unknown.","status":"open","published_at":"2026-10-23T14:17:56+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-25T04:18:55+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T04:18:55Z","model":"claude-haiku-5-5","output":{"fix":"- Move Zimbra Collaboration Suite to a fixed release; the sources do not name the fixed version, so unknown.","reach":"internet","title":"Zimbra Collaboration: forged calendar emails can cancel or alter recipients' meetings","impact":"low","summary":"Zimbra Collaboration Suite accepts iCalendar CANCEL and REQUEST messages without checking that the sender is the stated meeting organizer. An unauthenticated sender who knows a meeting UID and organizer address can move the recipient's meeting to Trash or overwrite its details.","category":"infrastructure","nicknames":[],"who_cares":["zimbra","self-hosted","email","calendar"],"confidence":0.6,"needs_auth":"no","worst_case":"Recipient's meetings get cancelled or replaced by forged calendar emails","analyst_note":"Confirm the fixed Zimbra version and whether other releases are affected; the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-93627 is the only source.","how_to_check":"- Check the installed Zimbra version (`su - zimbra -c \"zmcontrol -v\"`) and compare it with the affected releases `10.1.16` and `10.1.21`.","needs_analyst":true,"not_affected_if":["other-versions"],"who_is_affected":"Organizations running Zimbra Collaboration Suite versions 10.1.16 and 10.1.21, where incoming email with calendar invitations is processed automatically. Deployments on other versions are not named in the sources, and the sources do not say whether the flaw needs any non-default setting.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000642,"input_tokens":3440,"output_tokens":596,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-93627':14A,17A '10.1.16':158C '10.1.21':160C 'accept':28B,98C 'act':113C 'address':54B,127C 'affect':162C 'allow':81C 'alter':9A 'attack':119C 'authent':69C 'author':111C 'automat':150C 'calendar':4A,18B,74C,96C 'cancel':7A,30B,86C,100C 'check':35B 'collabor':2A,26B,78C 'compon':103C 'cve':12A,15A 'deliveri':153C 'detail':66B,147C 'email':5A,19B,73C,108C,152C 'exist':90C 'forg':3A 'host':23B 'icalendar':29B,99C 'infrastructur':20B 'interact':156C 'know':48B,121C 'meet':11A,42B,50B,60B,91C,123C,141C 'messag':33B 'modifi':88C 'move':56B,137C 'non':132C 'non-outd':131C 'number':135C 'occur':149C 'organ':43B,53B,68C,117C,126C 'outdat':133C 'overwrit':64B 'process':75C,148C 'recipi':10A,58B,94C,139C,155C 'replac':145C 'request':32B,102C 'self':22B 'self-host':21B 'sender':38B,46B,84C,109C 'sequenc':134C 'state':41B 'suit':27B,79C 'suppli':116C,129C 'trash':62B,143C 'uid':51B,124C 'unauthent':45B,83C 'verifi':105C 'vulner':70C 'without':34B,104C,154C 'zcs':80C,157C 'zimbra':1A,24B,25B,77C,97C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Zimbra Collaboration Suite versions 10.1.16 and 10.1.21, where incoming email with calendar invitations is processed automatically. Deployments on other versions are not named in the sources, and the sources do not say whether the flaw needs any non-default setting.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T14:17:56+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"cve@rapid7.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-93627","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93627","severity":null,"published_at":"2026-10-23T14:17:56+00:00","modified_at":"2026-10-23T16:44:17+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-93627","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-93627","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}