Zimbra Collaboration Suite 10.0/10.1 Flickr Zimlet hard-coded credentials

Summaryinfo

A vulnerability was found in Zimbra Collaboration Suite 10.0/10.1. It has been rated as critical. The impacted element is an unknown function of the component Flickr Zimlet. The manipulation leads to hard-coded credentials. This vulnerability is uniquely identified as CVE-2025-67809. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability was found in Zimbra Collaboration Suite 10.0/10.1 and classified as critical. This issue affects an unknown function of the component Flickr Zimlet. The manipulation with an unknown input leads to a hard-coded credentials vulnerability. Using CWE to declare the problem leads to CWE-798. The product contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A hardcoded Flickr API key and secret are present in the publicly accessible Flickr Zimlet used by Zimbra Collaboration. Because these credentials are embedded directly in the Zimlet, any unauthorized party could retrieve them and misuse the Flickr integration. An attacker with access to the exposed credentials could impersonate the legitimate application and initiate valid Flickr OAuth flows. If a user is tricked into approving such a request, the attacker could gain access to the user s Flickr data. The hardcoded credentials have since been removed from the Zimlet code, and the associated key has been revoked.

The advisory is shared at wiki.zimbra.com. The identification of this vulnerability is CVE-2025-67809 since 12/12/2025. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 01/02/2026). MITRE ATT&CK project uses the attack technique T1110.001 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2025-2911). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Affected

• Synacor Zimbra

Productinfo

Type

• Groupware Software

Vendor

• Zimbra

Name

• Collaboration Suite

Version

• 10.0
• 10.1

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion