Organizer Authentication Flaw in Zimbra Collaboration Suite

CVE-2026-93627

What is CVE-2026-93627?

A vulnerability in the email calendar processing of Zimbra Collaboration Suite permits an attacker to cancel or alter existing meetings in a user's calendar without authentication. When Zimbra processes iCalendar CANCEL and REQUEST messages, it fails to validate the authenticity of the sender, enabling unauthorized manipulation of meetings if the attacker knows the meeting UID and organizer's email address. With a non-outdated sequence number, the attacker can move a recipient's meeting to Trash or modify its details seamlessly during email delivery, requiring no user interaction to execute the changes. The affected versions include ZCS 10.1.16 and 10.1.21.

References