Zimbra Collaboration Suite: Request attribute override in Classic Web Client RestFilter
Summary
A request attribute override in the Classic Web Client (/h/*) of Zimbra Collaboration Suite lets crafted URL parameters set internal dispatch attributes, including an authentication token, target account and target item. Combined with CVE-2026-10632 on ZCS 10.1.16, an attacker can supply their own valid token and document identifiers and execute JavaScript in another signed-in user's browser session. The victim must open a crafted link. ZCS 10.1.17 blocks the XSS chain but keeps the override.
Affected
- Zimbra Collaboration Suite up to and including 10.1.17 (CNA-listed range; one aggregator lists all versions)
- Chain requires CVE-2026-10632 on ZCS 10.1.16 for the XSS impact
Fixed in
Unknown. ZCS 10.1.17 does not fix the request attribute override. No vendor fix naming CVE-2026-50053 was found.
Workaround
- No vendor-published workaround found.
- Unverified option: restrict external access to /h/ paths at the reverse proxy or firewall, if users can switch to the modern client. Test first and confirm with Zimbra.
Exploitation
- No known exploitation in the wild found; Rapid7 lists it as not exploited.
- No public proof of concept found in the searches performed.
- CISA SSVC: Automatable no, Technical Impact total.
Our recommendation
- Run zmcontrol -v to check the installed version now.
- Upgrade to the newest supported ZCS release and at least apply the 10.1.17 fixes.
- Monitor Zimbra's security advisories for a fix that names CVE-2026-50053 and request written confirmation of the fixed release from the vendor.
- Consider the proxy restriction on /h/ paths while waiting for a fix.
- Check logs for unusual /h/ requests with token or item parameters.
- Warn users not to open unexpected links while signed in to Zimbra.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Zimbra Security Advisories wiki.zimbra.com
- Rapid7: From One Account to Every Mailbox: Breaking Zimbra's Identity Boundaries (Part 1) www.rapid7.com
- NVD: CVE-2026-50053 (via Vulners) vulners.com
- Strix: CVE-2026-50053 www.strix.ai
- Strix: CVE-2026-10632 www.strix.ai
- Zimbra Security Center wiki.zimbra.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:27.
Original description (NVD)
A request attribute override vulnerability in Zimbra Collaboration Suite (ZCS) allows unauthenticated requests to /h/* to populate servlet attributes intended for trusted internal dispatch. RestFilter copies URL parameters specifying an authentication token, target account, target item and dispatch state into the request attributes consumed by the Classic Web Client. Combined with CVE-2026-10632 on ZCS 10.1.16, this allows an attacker to supply their own valid token and document identifiers and execute JavaScript in another user's signed-in browser session. ZCS 10.1.17 blocks that XSS chain by changing the document renderer, but retains the request attribute override.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.