CVE-2026-93631 in Collaboration Suite
Summary
by MITRE • 10/23/2026
A cross-site request forgery vulnerability in the OAuth extension of Zimbra Collaboration Suite (ZCS) Network Edition allows an attacker to link an attacker-controlled external account to a victim's mailbox. The OAuth callback does not bind its state value or authorization code to the initiating Zimbra session and instead selects the destination mailbox from the browser's current authentication cookie. On a deployment with the provider configured, an attacker can induce a signed-in victim to load a callback containing a fresh code for the attacker's provider account. This creates a persistent data source that imports attacker-controlled contacts or events. With bidirectional CalDAV synchronization, appointments subsequently created or edited in the linked calendar are also disclosed to the attacker. ZCS 10.1.16 and 10.1.20 are affected.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified in the OAuth extension of Zimbra Collaboration Suite Network Edition represents a critical failure in session management and state validation during the authentication flow. Specifically, this is a Cross-Site Request Forgery (CSRF) flaw that exploits how the application handles the binding between an authorization request and the subsequent callback response. In standard secure implementations, such as those defined by OAuth 2.0 best practices, the server must validate that the state parameter returned in the callback matches the one originally sent with the authorization request to ensure the action was initiated by a legitimate user session. However, in this affected version of Zimbra, the system fails to bind the state value or the received authorization code to the initiating Zimbra session. Instead, it relies on the browser's current authentication cookie to determine which mailbox should receive the linked account credentials. This design flaw allows an attacker who has crafted a malicious link containing a valid OAuth callback with a fresh authorization code for their own external provider account to trick a victim into processing that request while logged into Zimbra.
The operational impact of this vulnerability is severe, as it enables unauthorized data exfiltration and persistence within the victim's environment. When an authenticated user inadvertently loads the malicious callback URL, the system associates the attacker-controlled external account with the victim’s mailbox without explicit consent or proper verification. This creates a persistent backdoor into the user's digital workspace. Because Zimbra supports bidirectional CalDAV synchronization for linked calendar accounts, any appointments created or edited in the attacker-controlled calendar are automatically synchronized to and from the victim's local calendar. Consequently, sensitive information such as meeting times, locations, attendees, and descriptions is disclosed to the attacker. Furthermore, if contact synchronization is enabled, the attacker can also inject malicious contacts into the victim’s address book, potentially facilitating further social engineering attacks or phishing campaigns against the victim's colleagues and business partners.
From a classification perspective, this vulnerability aligns with CWE-352: Cross-Site Request Forgery (CSRF), specifically due to the lack of anti-CSRF tokens or state validation in the OAuth callback handler. It also relates closely to CWE-613: Insufficient Session Expiration and CWE-807: Untrusted Data in Security Decision, as the system makes a critical security decision based on unvalidated external input (the authorization code) without verifying its origin against the current session context. In terms of the MITRE ATT&CK framework, this attack vector maps to T1566.002: Spearphishing Link and potentially T1199: Trusted Relationship Exploitation if the attacker leverages trusted OAuth providers to gain initial access. The persistence mechanism described allows for long-term surveillance or data theft without requiring repeated exploitation attempts once the account is linked.
Mitigation strategies must address both immediate remediation and architectural improvements. Organizations running Zimbra Collaboration Suite Network Edition versions 10.1.16 and 10.1.20 should apply vendor-provided patches immediately to update the OAuth extension logic. Administrators should enforce strict session management policies, ensuring that sensitive operations require re-authentication or explicit user confirmation when linking external accounts. Additionally, implementing Content Security Policy (CSP) headers can help mitigate some aspects of CSRF by restricting which origins are allowed to submit forms or make requests. Long-term architectural reviews should prioritize the implementation of robust state parameter validation in all OAuth flows, ensuring that authorization codes and states are cryptographically bound to specific user sessions rather than relying on ambient browser cookies for identity resolution. Regular audits of linked external accounts within mailboxes can also help detect unauthorized integrations early.