Mailbox Quota Accounting Vulnerability in Zimbra Collaboration Suite by Zimbra
CVE-2026-115786

6.5MEDIUM

Key Information:

Vendor

Zimbra

Status
Zimbra Collaboration Suite
Vendor
CVE Published:
23 October 2026

What is CVE-2026-115786?

A mailbox quota-accounting issue in Zimbra Collaboration Suite allows authenticated users to exploit another user’s mailbox quota. This is achieved by repeatedly sharing and revoking documents, which incorrectly increases the mailbox-wide usage despite the removal of visible records. As a result, users may reach their quota limit without any interaction, leading to potential disruptions in receiving emails and other mailbox operations, especially for accounts with bounded quotas. This vulnerability is identified in ZCS versions 10.1.16 and 10.1.20.

Affected Version(s)

Zimbra Collaboration Suite 0 <= 10.1.20

References

https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
vendor-advisory
https://www.rapid7.com/blog/post/ve-breaking-zimbra-ident...
related

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jonah Burgess (CryptoCat), Senior Security Researcher, Rapid7
.