CVE-2026-93628

An attendee authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to forge another attendee's response to an existing meeting. Zimbra passes a null sender identity when processing iCalendar REPLY components, causing the attendee authorization filter to be skipped. An attacker who knows the meeting UID, organizer address and attendee address can send a non-outdated reply that changes the attendee's participation status in the organizer's calendar. The change occurs automatically during delivery without organizer or attendee interaction. ZCS 10.1.16 and 10.1.21 are affected.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
https://www.rapid7.com/blog/post/ve-breaking-zimbra-identity-boundaries-part-1/

Configurations

No configuration.

History

23 Oct 2026, 14:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-23 14:17

Updated : 2026-10-28 20:18

NVD link : CVE-2026-93628

Mitre link : CVE-2026-93628

CVE.ORG link : CVE-2026-93628

JSON object : View

Products Affected

No product.

CWE

CWE-290

Authentication Bypass by Spoofing

{"id": "CVE-2026-93628", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-93628", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-28T18:23:55.530504Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@rapid7.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@rapid7.com", "affectedData": [{"vendor": "Zimbra", "product": "Zimbra Collaboration Suite", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "10.1.21"}], "defaultStatus": "unaffected"}]}], "published": "2026-10-23T14:17:56.667", "references": [{"url": "https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories", "source": "cve@rapid7.com"}, {"url": "https://www.rapid7.com/blog/post/ve-breaking-zimbra-identity-boundaries-part-1/", "source": "cve@rapid7.com"}], "vulnStatus": "Undergoing Analysis", "weaknesses": [{"type": "Secondary", "source": "cve@rapid7.com", "description": [{"lang": "en", "value": "CWE-290"}]}], "descriptions": [{"lang": "en", "value": "An attendee authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to forge another attendee's response to an existing meeting. Zimbra passes a null sender identity when processing iCalendar REPLY components, causing the attendee authorization filter to be skipped. An attacker who knows the meeting UID, organizer address and attendee address can send a non-outdated reply that changes the attendee's participation status in the organizer's calendar. The change occurs automatically during delivery without organizer or attendee interaction. ZCS 10.1.16 and 10.1.21 are affected."}], "lastModified": "2026-10-28T20:18:52.170", "sourceIdentifier": "cve@rapid7.com"}