Organizer Authentication Vulnerability in Zimbra Collaboration Suite
CVE-2026-93629

5.3MEDIUM

Key Information:

Vendor

Zimbra

Status
Zimbra Collaboration Suite
Vendor
CVE Published:
23 October 2026

What is CVE-2026-93629?

An authentication vulnerability in Zimbra Collaboration Suite allows unauthorized email senders to create fraudulent calendar invitations using an iCalendar ORGANIZER identity. This flaw enables attackers to insert crafted meeting requests into recipients' calendars without the legitimate organizer's consent, as the system does not verify sender authorization. Affected versions 10.1.16 and 10.1.21 permit this exploit when automatic invitation insertion is enabled, placing users at risk of phishing and other malicious activities.

Affected Version(s)

Zimbra Collaboration Suite 0 <= 10.1.21

References

https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
vendor-advisory
https://www.rapid7.com/blog/post/ve-breaking-zimbra-ident...
related

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jonah Burgess (CryptoCat), Senior Security Researcher, Rapid7
.