Live › vulnerability › CVE-2026-93634
Go to dashboardZimbra Collaboration Suite lets an authenticated user insert fake shared-file records into another local account's mailbox through the FileSharedWithMeRequest endpoint. The request skips delegated-account checks and does not verify that a share exists, so an attacker can plant entries that look like they came from a real user.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-hosted Zimbra Collaboration Suite deployments on the affected versions 10.1.16 and 10.1.20 are exposed, since any authenticated mailbox user can send the forged request. Teams using a hosted Zimbra provider or running other Zimbra versions can likely skip it, though the sources do not confirm the unaffected versions.
No product ranges from the sources yet.
zmcontrol -v on the mail server; versions 10.1.16 and 10.1.20 are listed as affected.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A cross-account authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to insert forged shared-file records into another user's mailbox through FileSharedWithMeRequest. The request bypasses delegated-account authorization and accepts attacker-selected file metadata, owner identifiers and declared sizes without validating a corresponding document share. An attacker can plant entries attributed to another real local account without that account sharing a document. No victim interaction is required. ZCS 10.1.16 and 10.1.20 are affected.
This page as .md · .json · in your agent: get_signal("CVE-2026-93634")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.