{"id":"CVE-2026-93639","kind":"vulnerability","aliases":["CVE-2026-93639"],"related":[],"title":"Zimbra Collaboration: delegated admin can plant XSS against mailbox users","description":"A missing authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows a delegated administrator with no explicit administrative grants to overwrite global Zimlet configuration through ConfigureZimletRequest. The uploaded configuration can also add an attacker-controlled domain to the proxy allowlist of the default class of service. If a signed-in user in that class opens a crafted /service/proxy URL, Zimbra serves attacker-controlled HTML under its own origin. The resulting JavaScript can read mailbox data and perform authenticated actions as the victim. Exploitation requires a delegated-administrator account and access to the admin SOAP service; the browser compromise additionally requires the victim to open the crafted URL. ZCS 10.1.16 and 10.1.20 are affected.","summary":"A delegated administrator with no explicit admin grants can overwrite global Zimlet configuration and add an attacker-chosen domain to the proxy allowlist. A signed-in user who opens a crafted /service/proxy URL then gets attacker HTML running under the Zimbra origin, which can read mail and act as the victim.","severity":"high","cvss":8.7,"epss":0.00356,"exploited":false,"exploited_at":null,"products":[{"name":"Zimbra Collaboration Suite","fixed":[],"affected":">= 0, <= 10.1.20","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["package","self-hosted","xss","zimbra"],"not_affected_if":["auth-required","managed-hosting","no-delegated-admins"],"how_to_check":"Check version with 'zmcontrol -v' on each mailbox node; 10.1.20 and earlier are affected. List delegated admin accounts and review who can reach the admin SOAP service (port 7071). Compare the global Zimlet config and zimbraProxyAllowedDomains on the default COS against what you expect: 'zmprov gcf zimbraProxyAllowedDomains' and 'zmprov gc default zimbraProxyAllowedDomains'. Look in the admin audit and mailbox logs for ConfigureZimletRequest from delegated admins and for unusual /service/proxy?target= URLs. (The config checks are inferred from the CVE text, not from a vendor page.)","fix":"No fixed version confirmed. Vendor advisory has no entry yet. Watch https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories and move to the first release that lists this CVE. Meanwhile, remove or limit delegated-admin accounts, restrict admin SOAP access (7071) to a management network, and remove unknown domains from the proxy allowlist.","status":"open","published_at":"2026-10-23T14:17:57+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-23T22:34:57+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T22:34:57Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Zimbra Collaboration: delegated admin can plant XSS against mailbox users","impact":"high","summary":"A delegated administrator with no explicit admin grants can overwrite global Zimlet configuration and add an attacker-chosen domain to the proxy allowlist. A signed-in user who opens a crafted /service/proxy URL then gets attacker HTML running under the Zimbra origin, which can read mail and act as the victim.","category":"package","who_cares":["zimbra","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"attacker reads victim mailbox and acts as the victim","analyst_note":"Sources do not list fixed versions or patch links beyond affected 10.1.16 and 10.1.20; check the Zimbra security advisory for the patched release and a config check for Zimlet/proxy allowlist changes.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["auth-required"],"user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000501,"input_tokens":3082,"output_tokens":385,"severity_before":"high"},"analyst_status":"done","analyst_note":"Sources do not list fixed versions or patch links beyond affected 10.1.16 and 10.1.20; check the Zimbra security advisory for the patched release and a config check for Zimlet/proxy allowlist changes.","search":"'-2026':12A,15A '-93639':13A,16A '/service/proxy':59B,137C '10.1.16':190C '10.1.20':192C 'access':171C 'account':169C 'act':75B 'action':159C 'add':40B,109C 'addit':180C 'admin':4A,32B,174C 'administr':28B,91C,95C,168C 'affect':194C 'allow':88C 'allowlist':49B,118C 'also':108C 'attack':43B,63B,112C,142C 'attacker-chosen':42B 'attacker-control':111C,141C 'authent':158C 'author':81C 'browser':178C 'chosen':44B 'class':122C,133C 'collabor':2A,85C 'collaboration':18A 'compromis':179C 'configur':38B,101C,106C 'configurezimletrequest':103C 'control':113C,143C 'craft':58B,136C,187C 'cve':11A,14A 'data':155C 'default':121C 'deleg':3A,27B,90C,167C 'delegated-administr':166C 'domain':45B,114C 'explicit':31B,94C 'exploit':163C 'get':62B 'global':36B,99C 'grant':33B,96C 'host':23B 'html':64B,144C 'javascript':151C 'mail':73B 'mailbox':9A,154C 'miss':80C 'open':56B,134C,185C 'origin':69B,148C 'overwrit':35B,98C 'packag':20B 'perform':157C 'plant':6A 'proxi':48B,117C 'read':72B,153C 'requir':164C,181C 'result':150C 'run':65B 'self':22B 'self-host':21B 'serv':140C 'servic':124C,176C 'sign':52B,128C 'signed-in':51B,127C 'soap':175C 'suit':86C 'suite':19A 'upload':105C 'url':60B,138C,188C 'user':10A,54B,130C 'victim':78B,162C,183C 'vulner':82C 'xss':7A,24B 'zcs':87C,189C 'zimbra':1A,17A,25B,68B,84C,139C 'zimlet':37B,100C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T14:17:57+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","cvss_by":"cve@rapid7.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-93639","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93639","severity":null,"published_at":"2026-10-23T14:17:57+00:00","modified_at":"2026-10-23T16:44:17+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-93639:474","url":null,"severity":null,"published_at":"2026-10-23T23:35:34+00:00","modified_at":"2026-10-23T23:35:34+00:00","first_seen_at":"2026-10-23T23:35:34+00:00","fetched_at":"2026-10-23T23:35:34+00:00","note":"CVE record (cve.org, CNA Rapid7): ZCS <= 10.1.20 affected (10.1.16, 10.1.20 named). No Zimbra advisory or release note lists a fix as of 2026-10-23; latest is 10.1.21 (Sep 24), which predates the CVE and is not confirmed as fixed. No public PoC, no exploitation reported, no X discussion (count 0)."},{"source":"epss","external_id":"CVE-2026-93639","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-93639","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[{"id":2064,"url":"https://www.cve.org/CVERecord?id=CVE-2026-93639","title":"CVE Record: CVE-2026-93639","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2060,"url":"https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories","title":"Zimbra Security Advisories (no entry for CVE-2026-50056 as of 2026-10-25)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":2061,"url":"https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.21","title":"Zimbra 10.1.21 release notes","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}