{"id":"CVE-2026-93634","kind":"vulnerability","aliases":["CVE-2026-93634"],"related":[],"title":"Zimbra Collaboration: forged shared-file entries planted in other users' mailboxes","description":"A cross-account authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to insert forged shared-file records into another user's mailbox through FileSharedWithMeRequest. The request bypasses delegated-account authorization and accepts attacker-selected file metadata, owner identifiers and declared sizes without validating a corresponding document share. An attacker can plant entries attributed to another real local account without that account sharing a document. No victim interaction is required. ZCS 10.1.16 and 10.1.20 are affected.","summary":"Zimbra Collaboration Suite lets an authenticated user insert fake shared-file records into another local account's mailbox through the FileSharedWithMeRequest endpoint. The request skips delegated-account checks and does not verify that a share exists, so an attacker can plant entries that look like they came from a real user.","severity":"medium","cvss":4.3,"epss":0.00295,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mail","package","self-hosted","zimbra"],"not_affected_if":["managed-hosting"],"how_to_check":"- Confirm the Zimbra Collaboration version with `zmcontrol -v` on the mail server; versions 10.1.16 and 10.1.20 are listed as affected.\n- unknown for other checks; the sources do not describe log entries or config flags to inspect.","fix":"- Zimbra Collaboration: move to a fixed release from the vendor; the sources do not name the fixed version.\n- unknown for interim mitigations; the sources do not say.","status":"open","published_at":"2026-10-23T14:17:57+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-25T04:37:17+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:37:17Z","model":"claude-haiku-5-5","output":{"fix":"- Zimbra Collaboration: move to a fixed release from the vendor; the sources do not name the fixed version.\n- unknown for interim mitigations; the sources do not say.","reach":"network","title":"Zimbra Collaboration: forged shared-file entries planted in other users' mailboxes","impact":"low","summary":"Zimbra Collaboration Suite lets an authenticated user insert fake shared-file records into another local account's mailbox through the FileSharedWithMeRequest endpoint. The request skips delegated-account checks and does not verify that a share exists, so an attacker can plant entries that look like they came from a real user.","category":"package","nicknames":[],"who_cares":["zimbra","self-hosted","mail"],"confidence":0.6,"needs_auth":"yes","worst_case":"Forged shared-file entries appear in other users' mailboxes","analyst_note":"Check the NVD entry and Zimbra's security advisory for the fixed version and any workaround; the sources give only the affected versions.","how_to_check":"- Confirm the Zimbra Collaboration version with `zmcontrol -v` on the mail server; versions 10.1.16 and 10.1.20 are listed as affected.\n- unknown for other checks; the sources do not describe log entries or config flags to inspect.","needs_analyst":true,"not_affected_if":["managed-hosting"],"who_is_affected":"Self-hosted Zimbra Collaboration Suite deployments on the affected versions 10.1.16 and 10.1.20 are exposed, since any authenticated mailbox user can send the forged request. Teams using a hosted Zimbra provider or running other Zimbra versions can likely skip it, though the sources do not confirm the unaffected versions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000656,"input_tokens":3406,"output_tokens":631,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-93634':15A,18A '10.1.16':155C '10.1.20':157C 'accept':115C 'account':41B,53B,81C,112C,142C,145C 'affect':159C 'allow':89C 'anoth':39B,101C,139C 'attack':65B,117C,133C 'attacker-select':116C 'attribut':137C 'authent':30B,91C 'author':82C,113C 'bypass':109C 'came':73B 'check':54B 'collabor':2A,26B,86C 'correspond':129C 'cross':80C 'cross-account':79C 'cve':13A,16A 'declar':124C 'deleg':52B,111C 'delegated-account':51B,110C 'document':130C,148C 'endpoint':47B 'entri':7A,68B,136C 'exist':62B 'fake':33B 'file':6A,36B,98C,119C 'filesharedwithmerequest':46B,106C 'forg':3A,95C 'host':23B 'identifi':122C 'insert':32B,94C 'interact':151C 'let':28B 'like':71B 'local':40B,141C 'look':70B 'mail':19B 'mailbox':12A,43B,104C 'metadata':120C 'owner':121C 'packag':20B 'plant':8A,67B,135C 'real':76B,140C 'record':37B,99C 'request':49B,108C 'requir':153C 'select':118C 'self':22B 'self-host':21B 'share':5A,35B,61B,97C,131C,146C 'shared-fil':4A,34B,96C 'size':125C 'skip':50B 'suit':27B,87C 'user':11A,31B,77B,92C,102C 'valid':127C 'verifi':58B 'victim':150C 'vulner':83C 'without':126C,143C 'zcs':88C,154C 'zimbra':1A,24B,25B,85C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Zimbra Collaboration Suite deployments on the affected versions 10.1.16 and 10.1.20 are exposed, since any authenticated mailbox user can send the forged request. Teams using a hosted Zimbra provider or running other Zimbra versions can likely skip it, though the sources do not confirm the unaffected versions.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T14:17:57+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"cve@rapid7.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-93634","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93634","severity":null,"published_at":"2026-10-23T14:17:57+00:00","modified_at":"2026-10-23T16:44:17+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-93634","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-93634","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}