Cross-Site Request Forgery in Zimbra Collaboration Suite OAuth Extension

CVE-2026-93631

What is CVE-2026-93631?

A cross-site request forgery vulnerability in the OAuth extension of Zimbra Collaboration Suite allows attackers to link an external account to a victim's mailbox without proper authorization checks. An attacker can take advantage of the way Zimbra handles OAuth callbacks, exploiting the cookie-based authentication. This flaw can lead to the import of attacker-controlled contacts and events into the victim's account, compromising sensitive information. Additionally, data created or modified through bidirectional CalDAV synchronization can be accessed by the attacker, further escalating the potential impact on victims.

References