Authorization Bypass Vulnerability in Zimbra Collaboration Suite
CVE-2026-10631

6.5MEDIUM

Key Information:

Vendor

Zimbra

Status
Zimbra Collaboration Suite
Vendor
CVE Published:
8 October 2026

What is CVE-2026-10631?

An authorization bypass vulnerability exists in the EWS FindItem handler of Zimbra Collaboration Suite versions 10.1.0 to 10.1.19. This flaw allows authenticated users with EWS enabled to access complete mailbox items from arbitrary local accounts without needing any sharing permissions or delegation grants. This represents a serious security concern as it exposes sensitive mailbox data, including raw MIME and attachments, potentially leading to data breaches and privacy violations.

Affected Version(s)

Zimbra Collaboration Suite 0 < 10.1.20

References

https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
vendor-advisory

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jonah Burgess (CryptoCat), Senior Security Researcher, Rapid7
.