CVE-2026-73571CWE-863broken-access-control

CVE-2026-73571

Low · published August 13, 2026

CVSS v3.1
3.1
EPSS
0%
Percentile
16.5
In the wild
Unconfirmed
What it is

An authorization bypass vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.17 due to improper authorization validation in delegated email sending functionality. An authenticated attacker can send specially crafted SOAP requests to impersonate another user and send emails without possessing the required delegation or send-as permissions. This occurs in the SaveDraftRequest SOAP handler.

The record
Technical detail
CVSS v3.1
3.1 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00258 · 16.5th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-08-13T20:19Z
Affected products (1)
ProductVersionsFixed in
synacor/zimbra_collaboration_suite< 10.1.1710.1.17
References (2)
https://wiki.zimbra.com/wiki/Security_Center · [email protected]https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories · [email protected]
EPSS history
Timeline
  • 13 AUG 15:20Z
    An authorization bypass vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.17 due to improper authorization validation in delegated email sending…
    cvelistv5