Authorization Flaw in Zimbra Collaboration Suite by Zimbra
CVE-2026-50054

7.1HIGH

Key Information:

Vendor

Zimbra

Status
Zimbra Collaboration Suite
Vendor
CVE Published:
8 October 2026

What is CVE-2026-50054?

An authorization flaw in Zimbra Collaboration Suite allows an attacker who has access to an authenticated account to grant another local account the 'loginAs' right. This grants persistent access, enabling the attacker to gain control over a mailbox and send emails on behalf of the account—even after password changes or session expirations, posing significant security risks.

Affected Version(s)

Zimbra Collaboration Suite 0 < 10.1.20

References

https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
vendor-advisory

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jonah Burgess (CryptoCat), Senior Security Researcher, Rapid7
.