Attendee Authentication Vulnerability in Zimbra Collaboration Suite by Zimbra

CVE-2026-93628

What is CVE-2026-93628?

The Zimbra Collaboration Suite has a flaw in its email calendar processing that allows an attacker to manipulate meeting responses without authorization. This occurs when the system processes iCalendar REPLY components, failing to verify sender identities. The flaw permits an unauthenticated sender to alter an attendee's response to an existing meeting, assuming they have knowledge of the meeting's unique identifier, the organizer's address, and the attendee's address. When an unsolicited response is sent, it can automatically change the attendee's participation status in the organizer’s calendar without interactions from the organizer or attendee, thereby undermining the integrity of the scheduling system.

References