CVE-2026-93631

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-93631
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93631.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-93631
Published
2026-10-23T13:23:34Z
Modified
2026-11-08T02:47:43Z
Severity
  • 7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N CVSS Calculator
Summary
Zimbra Collaboration Suite OAuth Extension Cross-Site Request Forgery Enables Account Linking
Details

A cross-site request forgery vulnerability in the OAuth extension of Zimbra Collaboration Suite (ZCS) Network Edition allows an attacker to link an attacker-controlled external account to a victim's mailbox. The OAuth callback does not bind its state value or authorization code to the initiating Zimbra session and instead selects the destination mailbox from the browser's current authentication cookie. On a deployment with the provider configured, an attacker can induce a signed-in victim to load a callback containing a fresh code for the attacker's provider account. This creates a persistent data source that imports attacker-controlled contacts or events. With bidirectional CalDAV synchronization, appointments subsequently created or edited in the linked calendar are also disclosed to the attacker. ZCS 10.1.16 and 10.1.20 are affected.

Database specific 
{
    "cna_assigner": "rapid7",
    "cwe_ids": [
        "CWE-352"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93631.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "last_affected": "10.1.20"
                        }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/zimbra/zm-build

Affected ranges

Type
GIT
Repo
https://github.com/zimbra/zm-build
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
c4837c66360979d757890271f6c976727e71bcad
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "last_affected": "10.1.20"
                }
            ],
            "source": "CPE_RANGE"
        }
    ]
}

Affected versions

10.*
10.1.0
10.1.1
10.1.10
10.1.13
10.1.14
10.1.16
10.1.20
10.1.4
10.1.5
10.1.6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93631.json"

Git / github.com/zimbra/zm-mailbox

Affected ranges

Type
GIT
Repo
https://github.com/zimbra/zm-mailbox
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
c80d2bbf562968d44fa90edd843f1985026585c3
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "last_affected": "10.1.20"
                }
            ],
            "source": "CPE_RANGE"
        }
    ]
}

Affected versions

10.*
10.1.0
10.1.1
10.1.10
10.1.13
10.1.14
10.1.16
10.1.17
10.1.18
10.1.2
10.1.20
10.1.3
10.1.4
10.1.5
10.1.6
10.1.7
10.1.8
8.*
8.8.11

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93631.json"