Skip to content
CVE PROGRAM SOURCE RECORD7.1 High

CVE-2026-50054

Zimbra Collaboration Suite GrantRightsRequest SOAP Handler Allows Self-Granting of Undocumented loginAs Mailbox Delegation Right

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
rapid7

Description

An authorization flaw in Zimbra Collaboration Suite’s GrantRightsRequest allows an attacker with access to an authenticated account to grant another local account the loginAs right, creating persistent mailbox access and mail-sending authority that survives password changes and session expiry.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Zimbra Zimbra Collaboration Suite

Default version status: unaffected

  • 0 to < 10.1.20affected

References