{"id":"CVE-2026-93631","kind":"vulnerability","aliases":["CVE-2026-93631"],"related":[],"title":"Zimbra Collaboration Suite: forged OAuth callback links attacker account to victim mailbox","description":"A cross-site request forgery vulnerability in the OAuth extension of Zimbra Collaboration Suite (ZCS) Network Edition allows an attacker to link an attacker-controlled external account to a victim's mailbox. The OAuth callback does not bind its state value or authorization code to the initiating Zimbra session and instead selects the destination mailbox from the browser's current authentication cookie. On a deployment with the provider configured, an attacker can induce a signed-in victim to load a callback containing a fresh code for the attacker's provider account. This creates a persistent data source that imports attacker-controlled contacts or events. With bidirectional CalDAV synchronization, appointments subsequently created or edited in the linked calendar are also disclosed to the attacker. ZCS 10.1.16 and 10.1.20 are affected.","summary":"A cross-site request forgery flaw in the OAuth extension of Zimbra Collaboration Suite Network Edition lets an attacker attach an external account they control to a signed-in user's mailbox. The attacker then imports contacts and events from that account and receives calendar appointments through bidirectional CalDAV sync.","severity":"high","cvss":7.1,"epss":0.00177,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["calendar","email","package","self-hosted","zimbra"],"not_affected_if":["default-config","no-oauth-provider"],"how_to_check":"- Confirm the deployment runs Zimbra Collaboration Suite Network Edition 10.1.x with the OAuth extension and an external OAuth provider configured\n- Check the installed version against `10.1.16` and `10.1.20`, which the sources list as affected\n- Check whether bidirectional CalDAV synchronization is enabled for linked calendars","fix":"- Upgrade Zimbra Collaboration Suite Network Edition to a release that fixes CVE-2026-93631 (fixed version unknown from the sources)\n- Remove or disable the OAuth external provider configuration until patched if the feature is not needed\n- Review existing external data sources and linked calendars for accounts the users did not add","status":"open","published_at":"2026-10-23T14:17:57+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-25T03:31:15+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:31:15Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Zimbra Collaboration Suite Network Edition to a release that fixes CVE-2026-93631 (fixed version unknown from the sources)\n- Remove or disable the OAuth external provider configuration until patched if the feature is not needed\n- Review existing external data sources and linked calendars for accounts the users did not add","reach":"internet","title":"Zimbra Collaboration Suite: forged OAuth callback links attacker account to victim mailbox","impact":"medium","summary":"A cross-site request forgery flaw in the OAuth extension of Zimbra Collaboration Suite Network Edition lets an attacker attach an external account they control to a signed-in user's mailbox. The attacker then imports contacts and events from that account and receives calendar appointments through bidirectional CalDAV sync.","category":"package","nicknames":[],"who_cares":["zimbra","self-hosted","email","calendar"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker reads victim's calendar appointments and imports attacker-controlled contacts and events","analyst_note":"Check the NVD entry and the Zimbra security advisory for the fixed version and whether Open Source Edition is affected; the sources give no fix version.","how_to_check":"- Confirm the deployment runs Zimbra Collaboration Suite Network Edition 10.1.x with the OAuth extension and an external OAuth provider configured\n- Check the installed version against `10.1.16` and `10.1.20`, which the sources list as affected\n- Check whether bidirectional CalDAV synchronization is enabled for linked calendars","needs_analyst":true,"not_affected_if":["default-config","no-oauth-provider"],"who_is_affected":"Only Zimbra Collaboration Suite Network Edition deployments with the OAuth extension and an external provider configured are exposed, and the sources name versions 10.1.16 and 10.1.20. Deployments without the provider configured are not affected, and the exposure is greater where bidirectional CalDAV sync is used. Open Source Edition is not named in the sources.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000726,"input_tokens":3496,"output_tokens":753,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-93631':15A,18A '10.1.16':206C '10.1.20':208C 'account':9A,49B,69B,106C,171C 'affect':210C 'allow':96C 'also':200C 'appoint':73B,190C 'attach':46B 'attack':8A,45B,61B,98C,103C,150C,168C,181C,204C 'attacker-control':102C,180C 'authent':140C 'author':122C 'bidirect':75B,187C 'bind':117C 'browser':137C 'caldav':76B,188C 'calendar':19B,72B,198C 'callback':6A,114C,161C 'code':123C,165C 'collabor':2A,39B,91C 'configur':148C 'contact':64B,183C 'contain':162C 'control':51B,104C,182C 'cooki':141C 'creat':173C,192C 'cross':28B,80C 'cross-sit':27B,79C 'current':139C 'cve':13A,16A 'data':176C 'deploy':144C 'destin':133C 'disclos':201C 'edit':42B,95C,194C 'email':20B 'event':66B,185C 'extens':36B,88C 'extern':48B,105C 'flaw':32B 'forg':4A 'forgeri':31B,83C 'fresh':164C 'host':24B 'import':63B,179C 'induc':152C 'initi':126C 'instead':130C 'let':43B 'link':7A,100C,197C 'load':159C 'mailbox':12A,59B,111C,134C 'network':41B,94C 'oauth':5A,35B,87C,113C 'packag':21B 'persist':175C 'provid':147C,170C 'receiv':71B 'request':30B,82C 'select':131C 'self':23B 'self-host':22B 'session':128C 'sign':55B,155C 'signed-in':54B,154C 'site':29B,81C 'sourc':177C 'state':119C 'subsequ':191C 'suit':3A,40B,92C 'sync':77B 'synchron':189C 'user':57B 'valu':120C 'victim':11A,109C,157C 'vulner':84C 'zcs':93C,205C 'zimbra':1A,25B,38B,90C,127C","nicknames":[],"mitigations":[],"who_affected":"Only Zimbra Collaboration Suite Network Edition deployments with the OAuth extension and an external provider configured are exposed, and the sources name versions 10.1.16 and 10.1.20. Deployments without the provider configured are not affected, and the exposure is greater where bidirectional CalDAV sync is used. Open Source Edition is not named in the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T14:17:57+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","cvss_by":"cve@rapid7.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-93631","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93631","severity":null,"published_at":"2026-10-23T14:17:57+00:00","modified_at":"2026-10-23T16:44:17+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-93631","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-93631","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}