CVE-2026-73571

4.3 Moyenne

Publiée le 13/08/2026 à 18:19 · Modifiée le 28/08/2026 à 15:58 · Analysée par le NVD · Source : cve@mitre.org

Description

An authorization bypass vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.17 due to improper authorization validation in delegated email sending functionality. An authenticated attacker can send specially crafted SOAP requests to impersonate another user and send emails without possessing the required delegation or send-as permissions. This occurs in the SaveDraftRequest SOAP handler.

Traduire en français

Produits concernés

Zimbra Collaboration
Synacor zimbra collaboration suite

Scores CVSS

Version	Score	Source	Vecteur
3.1	3.1 Faible	cve@mitre.org	`CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N`
3.1	4.3 Moyenne	nvd@nist.gov (NVD)	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N`

Faiblesses (CWE)

CWE-863

Références

https://wiki.zimbra.com/wiki/Security_Center Vendor Advisory
https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories Vendor Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories