CVE-2026-93642 PUBLISHED

Zimbra Collaboration Suite Modern Web Client Stored Cross-Site Scripting via Forged Share Invitation

Assigner: rapid7
Reserved: 18.09.2026 Published: 25.09.2026 Updated: 25.09.2026

An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Modern recipient clicks Accept Share, allowing the attacker to access mailbox data and act as the victim.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CVSS Score: 9.3

Attack Vector	Network	Scope	Changed
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	None	Integrity Impact	High
User Interaction	Required	Availability Impact	None

CVSS 3.1

Product Status

Vendor	Zimbra
Product	Zimbra Collaboration Suite (ZCS)
Versions	Default: unaffected affected from 0 to 10.1.21 (excl.)

Credits

Jonah Burgess (CryptoCat), Senior Security Researcher, Rapid7 finder

References

https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories

Problem Types

CWE-79 Improper neutralization of input during web page generation ('cross-site scripting') CWE