https://feed.craftedsignal.io/products/zimbra-collaboration-suite-10.1.20/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 23 Oct 2026 15:08:16 +0000https://feed.craftedsignal.io/favicon-32x32.pnghttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svghttps://feed.craftedsignal.io/briefs/2026-10-zimbra-cve-2026-93639/Fri, 23 Oct 2026 15:08:16 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-zimbra-cve-2026-93639/A missing authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows a delegated administrator to overwrite global Zimlet configurations and execute malicious JavaScript in a victim's session.<p>A missing authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows a delegated administrator with no explicit administrative grants to overwrite global Zimlet configuration through ConfigureZimletRequest. This allows an attacker to add an attacker-controlled domain to the proxy allowlist. If a signed-in user opens a crafted /service/proxy URL, Zimbra serves attacker-controlled HTML under its own origin. The resulting JavaScript can read mailbox data and perform authenticated actions as the victim. Exploitation requires a delegated-administrator account and access to the admin SOAP service; the browser compromise requires the victim to open the crafted URL. ZCS 10.1.16 and 10.1.20 are affected.</p> highadvisory