Missing Authorization Vulnerability in Zimbra Collaboration Suite

CVE-2026-93639

What is CVE-2026-93639?

A missing authorization vulnerability within Zimbra Collaboration Suite allows a delegated administrator to overwrite global Zimlet configurations without explicit administrative grants. This can lead to the addition of an attacker-controlled domain to the proxy allowlist. When a signed-in user, under the default class of service, accesses a specially crafted /service/proxy URL, Zimbra serves malicious HTML, which may execute JavaScript that can read the user’s mailbox data and perform actions as the victim. Exploitation necessitates a delegated-administrator account with access to the admin SOAP service, combined with user interaction to trigger the crafted URL.

References