Local Privilege Escalation in Zimbra Collaboration Suite MTA

CVE-2026-50057

What is CVE-2026-50057?

A local privilege escalation vulnerability exists within the Zimbra Collaboration Suite's MTA package, allowing the Unix zimbra account to execute arbitrary commands with root privileges. This is facilitated by a misconfigured sudo policy that permits passwordless execution of Postfix administrative commands without sufficient restrictions on their arguments. An attacker can exploit this flaw by selecting a zimbra-controlled daemon_directory in the Postfix configuration and executing postfix set-permissions, thus enabling them to run a post-install program as root. Given that the Postfix configuration directory is writable by the zimbra account, simply restricting postconf does not eliminate the security risk. Successful exploitation requires local command execution capabilities as the zimbra user on an MTA node.

References