CVE-2026-73575 in Collaboration
Summary
by MITRE • 08/13/2026
In Zimbra Collaboration (ZCS) before 10.1.17, a Cross-Site Request Forgery (CSRF) vulnerability exists in the Exchange Web Services (EWS) endpoint of Zimbra Collaboration (ZCS) due to insufficient validation of request content types. An attacker can exploit this vulnerability by causing an authenticated user to submit a crafted request, potentially allowing unauthorized actions to be performed on behalf of the victim.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/13/2026
The Cross-Site Request Forgery vulnerability in Zimbra Collaboration Suite versions prior to 10.1.17 represents a critical security flaw that undermines the integrity of the web services interface. This vulnerability specifically affects the Exchange Web Services endpoint, which serves as a crucial communication channel for email and calendar functionalities within the collaboration platform. The flaw stems from inadequate validation mechanisms that fail to properly verify the content type of incoming requests, creating an exploitable gap in the authentication and authorization framework.
The technical implementation of this CSRF vulnerability allows attackers to craft malicious requests that appear legitimate to the Zimbra server's EWS endpoint. When a victim user who is authenticated to the Zimbra system visits a malicious website or clicks on a compromised link, their browser automatically submits a crafted request to the Zimbra server without their knowledge or consent. This occurs because the server does not perform sufficient validation of the request origin or content type, making it impossible for the system to distinguish between legitimate requests from authorized users and maliciously constructed requests designed to exploit the authenticated session.
The operational impact of this vulnerability extends beyond simple unauthorized access to potentially compromise entire email workflows within an organization. An attacker could leverage this CSRF flaw to perform actions such as sending unauthorized emails, modifying calendar entries, accessing sensitive contacts, or even deleting important messages on behalf of authenticated users. The severity is compounded by the fact that Zimbra serves as a primary collaboration platform for many enterprises, making successful exploitation a significant threat to business continuity and data integrity.
This vulnerability aligns with CWE-352, which specifically addresses Cross-Site Request Forgery weaknesses in web applications, and maps to ATT&CK technique T1566.002 for the initial access phase through malicious web content. Organizations utilizing Zimbra Collaboration Suite should prioritize immediate patching to version 10.1.17 or later, as this release includes proper content type validation mechanisms that prevent unauthorized request processing. Additional mitigations include implementing Content Security Policy headers, enabling same-site cookies, and deploying web application firewalls to monitor for suspicious request patterns. Regular security assessments and user education about phishing risks remain essential components of a comprehensive defense strategy against such session manipulation attacks.