What’s Vulnerable › Vulnerabilities

CVE-2026-50054: Zimbra Collaboration Suite GrantRightsRequest SOAP Handler Allows Self-Granting of Undocumented loginAs Mailbox Delegation Right

• Severity: high (CVSS 7.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-08 · updated 2026-10-08
• Weakness: CWE-269

Description

An authorization flaw in Zimbra Collaboration Suite’s GrantRightsRequest allows an attacker with access to an authenticated account to grant another local account the loginAs right, creating persistent mailbox access and mail-sending authority that survives password changes and session expiry.

Affected products

• Zimbra Collaboration: before 10.1.20 — fixed in 10.1.20

How to fix

Upgrade to a fixed version: Zimbra Collaboration 10.1.20. Check the vendor advisory for mitigations.

In the news

• From One Account to Every Mailbox: Breaking Zimbra's Identity Boundaries (Part 1)

References

• https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories

Get alerted when CVE-2026-50054 or the next vulnerability affects your stack