Vulnerabilities

An authorization bypass vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.17 due to improper authorization validation in delegated email…

An authorization bypass vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.17 due to improper authorization validation in delegated email sending functionality. An authenticated attacker can send specially crafted SOAP requests to impersonate another user and send emails without possessing the required delegation or send-as permissions. This occurs in the SaveDraftRequest SOAP handler.

Read at NIST National Vulnerability Database (CVE API 2.0)

Vendor

Zimbra

Product

Zimbra Collaboration

CVSS

3.1

Exposure class

Email

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-73571 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 22
   Research Rapid7 17d ago

   From One Account to Every Mailbox: Breaking Zimbra's Identity Boundaries (Part 1)

   CVE-2026-93637CVE-2026-93635CVE-2026-73571+3 more Zimbra Rapid7
2. 12
   CVE NVD 13 Aug 2026

   In Zimbra Collaboration (ZCS) before 10.1.17, a path traversal vulnerability exists in the Zimbra Briefcase document editing functionality due to…

   CVSS 3.1 CVE-2026-73573 Zimbra