---
id: "CVE-2026-93627"
kind: "vulnerability"
aliases: ["CVE-2026-93627"]
title: "Zimbra Collaboration: forged calendar emails can cancel or alter recipients' meetings"
severity: "medium"
cvss: 5.3
epss: 0.00376
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["calendar", "email", "infrastructure", "self-hosted", "zimbra"]
not_affected_if: ["other-versions"]
published_at: "2026-10-23T14:17:56+00:00"
first_seen_at: "2026-10-23T21:57:34+00:00"
updated_at: "2026-10-25T12:38:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93627", "first_seen_at": "2026-10-23T21:57:34+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-93627", "first_seen_at": "2026-10-25T12:38:49+00:00"}]
---

# Zimbra Collaboration: forged calendar emails can cancel or alter recipients' meetings

Zimbra Collaboration Suite accepts iCalendar CANCEL and REQUEST messages without checking that the sender is the stated meeting organizer. An unauthenticated sender who knows a meeting UID and organizer address can move the recipient's meeting to Trash or overwrite its details.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Zimbra version (`su - zimbra -c "zmcontrol -v"`) and compare it with the affected releases `10.1.16` and `10.1.21`.

## Fix

- Move Zimbra Collaboration Suite to a fixed release; the sources do not name the fixed version, so unknown.

## Timeline

- 2026-10-23T21:57:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-93627
- 2026-10-25T12:38:49+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-93627

## From the sources

An organizer authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to cancel or modify an existing meeting in a recipient's calendar. Zimbra accepts iCalendar CANCEL and REQUEST components without verifying that the email sender is authorized to act as the supplied organizer. An attacker who knows the meeting UID and organizer address can supply a non-outdated sequence number to move the recipient's meeting to Trash or replace its details. Processing occurs automatically during email delivery without recipient interaction. ZCS 10.1.16 and 10.1.21 are affected.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_