Zimbra Collaboration Suite GrantRightsRequest SOAP Handler Allows Self-Granting of Undocumented loginAs Mailbox Delegation Right (Zimbra Zimbra Collaboration Suite)
En bref
- Source
- NVD
- EPSS
- EPSS 0.17 % · centile 6 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- rapid7
- Statut NVD
- Awaiting Analysis
Rechercher sur…
Description
An authorization flaw in Zimbra Collaboration Suite’s GrantRightsRequest allows an attacker with access to an authenticated account to grant another local account the loginAs right, creating persistent mailbox access and mail-sending authority that survives password changes and session expiry.
Faiblesses (CWE)
- CWE-269 — Gestion incorrecte des privilèges
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N | rapid7 |
| CVSS 3.1 | HIGH 7.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N | NVD · cve@rapid7.com (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2026-95097
- GCVE · GCVE-0-2026-50054
Avis du CERT-FR
- CERTFR-2026-AVI-1041 — Multiples vulnérabilités dans Synacor Zimbra Collaboration · cert.ssi.gouv.fr
Produits affectés
| Produit | Versions |
|---|---|
| Zimbra · Zimbra Collaboration Suite | affected 0 < 10.1.20 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |