CVE-2026-50055
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
A policy-enforcement flaw in Zimbra Collaboration Suite allows an authenticated user to bypass disabled mail forwarding by using a Sieve notify action to send copies of email content and headers to an arbitrary address.
Risk Assessment
An authenticated user can bypass the disabled mail forwarding policy and leak email content and headers to external addresses, compromising correspondence confidentiality.
Recommendation
Update Zimbra Collaboration Suite to a patched version or restrict the use of the Sieve notify action in line with organizational policy.
Other vulnerabilities in Zimbra Collaboration Suite
See all- CVE-2022-37042CriticalActively exploited
Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication (i.e., not having an authtoken), an attacker can upload arbitrary files to the system, leading to directory traversal and remote code execution. NOTE: this issue exists because of an incomplete fix for CVE-2022-27925.
- CVE-2022-27925HighActively exploited
Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with administrator rights has the ability to upload arbitrary files to the system, leading to directory traversal.
- CVE-2022-24682MediumActively exploited
The Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 allows an attacker to place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.
- CVE-2019-9621HighActively exploited
An SSRF vulnerability in the ProxyServlet component of Zimbra Collaboration Suite. It allows an attacker to send requests from the server to internal resources.
- CVE-2018-6882MediumActively exploited
A cross-site scripting (XSS) vulnerability in ZmMailMsgView.getAttachmentLinkHtml in Zimbra Collaboration Suite (ZCS) before 8.7 Patch 1 and 8.8.x before 8.8.7. Remote attackers can inject arbitrary web script or HTML via a Content-Location header in an email attachment.
- CVE-2026-50054High
An authorization flaw in Zimbra Collaboration Suite's GrantRightsRequest allows an attacker with access to an authenticated account to grant another local account the loginAs right, creating persistent mailbox access and mail-sending authority that survives password changes and session expiry.
- CVE-2026-10631Medium
An authorization bypass in the EWS FindItem handler of Zimbra Collaboration Suite 10.1.0 through 10.1.19 allows an authenticated user with EWS enabled to read complete mailbox items, including raw MIME and attachments, from arbitrary local accounts without a share or delegation grant.
Original NVD description (English source)
A policy-enforcement flaw in Zimbra Collaboration Suite allows an authenticated user to bypass disabled mail forwarding by using a Sieve notify action to send copies of email content and headers to an arbitrary address.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS