Zimbra Auth Flaw: GrantRightsRequest Enables Persistent LoginAs
CVE-2026-50054 Published on October 8, 2026
Zimbra Collaboration Suite GrantRightsRequest SOAP Handler Allows Self-Granting of Undocumented loginAs Mailbox Delegation Right
An authorization flaw in Zimbra Collaboration Suites GrantRightsRequest allows an attacker with access to an authenticated account to grant another local account the loginAs right, creating persistent mailbox access and mail-sending authority that survives password changes and session expiry.
Vulnerability Analysis
CVE-2026-50054 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity, and no impact on availability.
Weakness Type
Improper Privilege Management
The software does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Products Associated with CVE-2026-50054
Want to know whenever a new CVE is published for Zimbra Collaboration Suite? stack.watch will email you.
Affected Versions
Zimbra Collaboration Suite:- Before 10.1.20 is affected.