Skip to content
CVE PROGRAM SOURCE RECORD9.3 Critical

CVE-2026-93641

Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Forged Share Invitation

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
rapid7

Description

An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Classic recipient clicks Accept Share, allowing the attacker to access mailbox data and act as the victim.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Zimbra Zimbra Collaboration Suite (ZCS)

Default version status: unaffected

  • 0 to < 10.1.21affected

References