Zimbra Collaboration Suite: Missing authorization in ConfigureZimlet allows cross-account XSS
Summary
A delegated administrator without explicit administrative grants can overwrite the global Zimlet configuration through the ConfigureZimletRequest admin SOAP call (CWE-862). The uploaded configuration can add an attacker-controlled domain to the proxy allowlist of the default class of service. If a signed-in user opens a crafted /service/proxy URL, attacker-controlled HTML is served under the Zimbra origin, and the script can read mailbox data and perform actions as the victim.
Affected
- Zimbra Collaboration Suite 10.1.16 and 10.1.20 (CVE record: versions up to and including 10.1.20)
Fixed in
Unknown. The vendor advisory could not be verified; check https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories for the fixed release.
Workaround
- No confirmed vendor workaround.
- Restrict delegated administrator accounts to the minimum required rights.
- Review Proxy Allowed Domains under Class of Service > Advanced and remove unauthorized domains.
- Consider disabling Zimlets that are not required.
Exploitation
- Requires a delegated administrator account with access to the admin SOAP service.
- The browser-side compromise additionally requires a victim to open a crafted /service/proxy URL.
- CISA SSVC: exploitation none, not automatable, total technical impact.
Our recommendation
- Apply the vendor patch as soon as the fixed release is confirmed.
- Until then, limit delegated administrator rights and review them.
- Review proxy allowlists and Zimlet configuration for unexpected domains.
- Monitor ConfigureZimletRequest activity in admin logs.
- Warn users not to open unexpected /service/proxy links.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Zimbra Security Advisories wiki.zimbra.com
- Rapid7: From One Account to Every Mailbox (Part 1) www.rapid7.com
- VulDB CVE-2026-93639 vuldb.com
- Vulners NVD CVE-2026-93639 vulners.com
- Zextras ConfigureZimlet API reference docs.zextras.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:26.
Original description (NVD)
A missing authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows a delegated administrator with no explicit administrative grants to overwrite global Zimlet configuration through ConfigureZimletRequest. The uploaded configuration can also add an attacker-controlled domain to the proxy allowlist of the default class of service. If a signed-in user in that class opens a crafted /service/proxy URL, Zimbra serves attacker-controlled HTML under its own origin. The resulting JavaScript can read mailbox data and perform authenticated actions as the victim. Exploitation requires a delegated-administrator account and access to the admin SOAP service; the browser compromise additionally requires the victim to open the crafted URL. ZCS 10.1.16 and 10.1.20 are affected.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.