Live › vulnerability › CVE-2026-93639
Go to dashboardA delegated administrator with no explicit admin grants can overwrite global Zimlet configuration and add an attacker-chosen domain to the proxy allowlist. A signed-in user who opens a crafted /service/proxy URL then gets attacker HTML running under the Zimbra origin, which can read mail and act as the victim.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| Zimbra Collaboration Suite | vendor | >= 0, <= 10.1.20 | – |
zmcontrol -v on each mailbox node; 10.1.20 and earlier are affectedzmprov gcf zimbraProxyAllowedDomains and zmprov gc default zimbraProxyAllowedDomainsEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A missing authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows a delegated administrator with no explicit administrative grants to overwrite global Zimlet configuration through ConfigureZimletRequest. The uploaded configuration can also add an attacker-controlled domain to the proxy allowlist of the default class of service. If a signed-in user in that class opens a crafted /service/proxy URL, Zimbra serves attacker-controlled HTML under its own origin. The resulting JavaScript can read mailbox data and perform authenticated actions as the victim. Exploitation requires a delegated-administrator account and access to the admin SOAP service; the browser compromise additionally requires the victim to open the crafted URL. ZCS 10.1.16 and 10.1.20 are affected.
This page as .md · .json · in your agent: get_signal("CVE-2026-93639")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.