{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/zimbra-collaboration-suite-10.1.16/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.7,"id":"CVE-2026-93639"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Zimbra Collaboration Suite 10.1.16","Zimbra Collaboration Suite 10.1.20"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eA missing authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows a delegated administrator with no explicit administrative grants to overwrite global Zimlet configuration through ConfigureZimletRequest. This allows an attacker to add an attacker-controlled domain to the proxy allowlist. If a signed-in user opens a crafted /service/proxy URL, Zimbra serves attacker-controlled HTML under its own origin. The resulting JavaScript can read mailbox data and perform authenticated actions as the victim. Exploitation requires a delegated-administrator account and access to the admin SOAP service; the browser compromise requires the victim to open the crafted URL. ZCS 10.1.16 and 10.1.20 are affected.\u003c/p\u003e\n","date_modified":"2026-10-23T15:08:16Z","date_published":"2026-10-23T15:08:16Z","id":"https://feed.craftedsignal.io/briefs/2026-10-zimbra-cve-2026-93639/","summary":"A missing authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows a delegated administrator to overwrite global Zimlet configurations and execute malicious JavaScript in a victim's session.","title":"Zimbra Collaboration Suite: Missing authorization in ConfigureZimletRequest (CVE-2026-93639)","url":"https://feed.craftedsignal.io/briefs/2026-10-zimbra-cve-2026-93639/"}],"language":"en","title":"CraftedSignal Threat Feed - Zimbra Collaboration Suite 10.1.16","version":"https://jsonfeed.org/version/1.1"}