Live › vulnerability › CVE-2026-93629
Go to dashboardZimbra Collaboration Suite does not check that an emailed calendar invitation's ORGANIZER is allowed to send it, so an outside sender can create events attributed to another user. The attacker controls the meeting details and reminders, and the recipient does not need to interact.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Zimbra Collaboration Suite installs on the 10.1.16 and 10.1.21 lines are affected when the email delivery path accepts external calendar invitations and automatic invitation insertion is enabled. Installs that do not accept external invitations, or that keep automatic insertion off, are less exposed. The sources do not say whether managed or hosted Zimbra is affected.
No product ranges from the sources yet.
su - zimbra -c "zmcontrol -v"10.1.16 and 10.1.21 (the sources do not name the fixed version, unknown)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An organizer authentication vulnerability in Zimbra Collaboration Suite (ZCS) allows an unauthenticated email sender to insert calendar invitations attributed to another user. The email delivery path permits external invitations but does not verify that the message sender is authorized to use the iCalendar ORGANIZER identity. When automatic invitation insertion is enabled, a crafted REQUEST component creates an event containing attacker-selected meeting details and reminders under a forged organizer without recipient interaction. No corresponding event is created in the claimed organizer's calendar. ZCS 10.1.16 and 10.1.21 are affected.
This page as .md · .json · in your agent: get_signal("CVE-2026-93629")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.