LDAP Filter Injection Vulnerability in Zimbra Collaboration Suite

CVE-2026-93636

What is CVE-2026-93636?

An LDAP filter injection flaw in Zimbra Collaboration Suite permits authenticated users to query and retrieve otherwise restricted attributes of calendar resources via SearchCalendarResourcesRequest. While Zimbra escapes search values, it directly incorporates the supplied attribute names into LDAP filter expressions without proper validation. This weakness enables attackers to inject additional criteria, allowing them to conduct repeated matching queries that may expose sensitive resource attributes, such as internal mailbox hostnames and mail transport routes. Access remains limited to the restrictions of calendar-resource objects and the LDAP service account's permissions.

References