CVE-2026-93631
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
A cross-site request forgery vulnerability in the OAuth extension of Zimbra Collaboration Suite (ZCS) Network Edition allows an attacker to link an attacker-controlled external account to a victim's mailbox. The OAuth callback does not bind its state value or authorization code to the initiating Zimbra session and selects the destination mailbox from the browser's current authentication cookie. An attacker can induce a signed-in victim to load a callback with a fresh code for the attacker's account, creating a persistent data source that imports attacker-controlled contacts or events; with bidirectional CalDAV synchronization, calendar appointments are also disclosed.
Risk Assessment
An attacker can persistently link their account to the victim's mailbox, import malicious data, and exfiltrate calendar information, impacting confidentiality and integrity.
Recommendation
Update ZCS to the patched version. Review configured OAuth links and remove unknown linked accounts.
Related vulnerabilities
- CVE-2026-122051Critical
A flaw was found in Edimax BR-6208AC version 1.32 in an unknown functionality of the /goform/mp file. Input manipulation can lead to command injection. The attack can be launched remotely and the exploit has been published.
- CVE-2026-54384Critical
VitaFit cloud API before 2026-10-30 contained an authentication bypass vulnerability that allows remote attackers to obtain a full session for a victim's account by submitting a linked Google or Facebook account identifier to the POST /front/login/sns/ endpoint without providing proof of ownership from the identity provider. Attackers can forge a login using an identifier exposed through account enumeration to read and modify the victim's profile and delete the account's authentication record.
- CVE-2026-52848Critical
GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, during the login phase, an unauthenticated user could use a crafted URL to skip one-time-password verification, defeating two-factor authentication. This issue is fixed in version 11.0.8.
- CVE-2026-115770Critical
Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 2.2.0 until 2.12.0, SendEmailVerification binds an email-verification token only to the user's identifier, while UpdateUser can change the account email without invalidating the outstanding token and VerifyEmail marks the current address as verified. An ordinary user can request a token for an address they control, change the account to an arbitrary unused address, and redeem the old token so Pocket ID publishes the new address with email_verified set to true.
- CVE-2026-97693Critical
Yuxi from 0.6.0.beta1 until 0.7.1 has insufficient isolation between execution-capable Docker sandboxes and trusted application services. A low-privileged authenticated user can reach other tenants' sandbox APIs, access their files and secrets, execute commands in active sandboxes, and enumerate, create, or delete sandboxes through the unauthenticated provisioner without knowing administrator, database, or MinIO credentials.
- CVE-2026-57566Critical
Readest prior to 0.11.10 contains an unauthenticated /api/opds/proxy route that fetches an attacker-controlled URL server-side without restricting the scheme, blocking private, loopback, link-local, or metadata hosts, or revalidating destinations during redirects. The route also accepts caller-controlled outbound headers and Authorization values and reflects the upstream status and response body.
- CVE-2026-54378Critical
VitaFit cloud API before 2026-10-30 contained a broken access control vulnerability that allows any authenticated user to obtain temporary AWS credentials by calling the POST /front/user/s3/token/ endpoint. Attackers can use these improperly scoped credentials to list the shared storage bucket and read or overwrite other users' stored files.
- CVE-2026-102895Critical
GPUStack prior to 2.2.0 treated a loopback request source as the built-in administrator when force_auth_localhost was false, which was the default. A remote request could appear to originate from 127.0.0.1, allowing unauthenticated administrative access, including user and model changes, persistent administrator API-key creation, disclosure of worker and cloud-provider secrets, and code execution.
- CVE-2026-102894Critical
GPUStack from 0.7.1 until 2.2.2 contains an /auth/saml/callback endpoint that decodes SAML XML and uses its NameID and attributes to resolve or provision a user without verifying the signature, issuer, audience, destination, or time conditions. Any network client could submit an identity for an existing user, including an administrator, or provision a new account, even when SAML was not configured.
- CVE-2026-82418Critical
IBM Watson Speech Services Cartridge versions 4.0.0 through 5.4.0 contain a use-after-free vulnerability that could allow a remote attacker to execute arbitrary code.
Original NVD description (English source)
A cross-site request forgery vulnerability in the OAuth extension of Zimbra Collaboration Suite (ZCS) Network Edition allows an attacker to link an attacker-controlled external account to a victim's mailbox. The OAuth callback does not bind its state value or authorization code to the initiating Zimbra session and instead selects the destination mailbox from the browser's current authentication cookie. On a deployment with the provider configured, an attacker can induce a signed-in victim to load a callback containing a fresh code for the attacker's provider account. This creates a persistent data source that imports attacker-controlled contacts or events. With bidirectional CalDAV synchronization, appointments subsequently created or edited in the linked calendar are also disclosed to the attacker. ZCS 10.1.16 and 10.1.20 are affected.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS