Zimbra ZCS 10.1.16/20: Missing Auth Lets Delegated Admin Overwrite Zimlet & Inject Proxy Allowlist
CVE-2026-93639 Published on October 23, 2026
Zimbra Collaboration Suite Missing Authorization in ConfigureZimlet Enables Delegated Administrator Privilege Escalation
A missing authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows a delegated administrator with no explicit administrative grants to overwrite global Zimlet configuration through ConfigureZimletRequest. The uploaded configuration can also add an attacker-controlled domain to the proxy allowlist of the default class of service. If a signed-in user in that class opens a crafted /service/proxy URL, Zimbra serves attacker-controlled HTML under its own origin. The resulting JavaScript can read mailbox data and perform authenticated actions as the victim. Exploitation requires a delegated-administrator account and access to the admin SOAP service; the browser compromise additionally requires the victim to open the crafted URL. ZCS 10.1.16 and 10.1.20 are affected.
Vulnerability Analysis
CVE-2026-93639 can be exploited with network access, requires user interaction and a small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and no impact on availability.
Weakness Type
What is an AuthZ Vulnerability?
The software does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVE-2026-93639 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2026-93639
Want to know whenever a new CVE is published for Zimbra Collaboration Suite? stack.watch will email you.
Affected Versions
Zimbra Collaboration Suite:- Before and including 10.1.20 is affected.