Rapid7's Zimbra research breaks the account boundary: cross-user mail reads, send-as and forwarding bypass, with public PoCs. Two flaws have no fix yet.
Rapid7 disclosed five vulnerabilities in Zimbra Collaboration Suite (ZCS) on 14 October 2026, each with a public proof-of-concept script. Three are fixed in ZCS 10.1.17 or 10.1.20. Two, CVE-2026-93635 and CVE-2026-93637, had no fix listed at publication, and NVD lists them as affecting ZCS through 10.1.21, the latest release Rapid7 mentions. Each bug scores low to medium on its own. Together they let an ordinary user read other people's mail, send as them, siphon copies outside forwarding policy, and guess directory passwords without tripping lockouts.
The write-up, "From One Account to Every Mailbox," is Part 1 by Rapid7 researcher Jonah Burgess. Rapid7 says its assessment reported more than 80 vulnerabilities in total, and later parts will cover more. Testing used ZCS 10.1.16 Network Edition on Ubuntu 22.04.
The five bugs
| CVE | Flaw | Rapid7 score | Fixed in |
|---|---|---|---|
| CVE-2026-10631 | EWS cross-user mailbox access | 6.5 (CVSS 3.1) | 10.1.20 |
| CVE-2026-50055 | Sieve notify bypasses forwarding restriction | 6.5 (CVSS 3.1) | 10.1.20 |
| CVE-2026-73571 | Impersonation via SaveDraftRequest | 8.3 (CVSS 4.0) | 10.1.17 |
| CVE-2026-93635 | LDAP filter injection | 5.3 (CVSS 3.1) | none listed |
| CVE-2026-93637 | GraphQL rate-limit bypass | 3.7 (CVSS 3.1) | none listed |
CVE-2026-10631. The EWS FindItem operation trusts the owner ID inside a composite folder ID. An authenticated user with EWS enabled can read another local user's Inbox, Sent, Drafts, Contacts or Calendar, including raw MIME and attachments, with no share or delegation. The target does not need EWS, and it works across servers in a cluster. NVD lists 10.1.0 through 10.1.19 as affected. Rapid7 narrowed the scope from an earlier conference version that also named GetItem, send, move and delete.
CVE-2026-50055. When an admin disables mail forwarding, Zimbra blocks only the Sieve redirect action. The notify action still sends message headers and the text body to an outside address, and the rule persists. The Modern Filters view does not show it, and Classic shows the rule name but not the destination. Attachments and raw MIME are not forwarded.
CVE-2026-73571. A delegated-send path in SaveDraftRequest lets any authenticated user send mail as another local account on the same mailbox server, without send-as rights. The message goes through the normal outbound pipeline and lands in the victim's Sent folder.
CVE-2026-93635. An unescaped wildcard in login on domains using external LDAP search-filter authentication with lazy provisioning gives an attacker a password oracle for directory users. Authenticated S/MIME lookups can also return certificates and identity data for unintended entries. Default local authentication is not affected.
CVE-2026-93637. Failed GraphQL authenticate attempts skip the per-IP failure counter, and GraphQL aliases batch many guesses into one request. Rapid7 ran 10,000 candidates, 100 per request, in under two minutes. Per-account lockout, off by default, still counts these failures when enabled. Rapid7 reports that pairing this with CVE-2026-93635 avoided both lockout counters in its test setup.
Rapid7's scores. NVD rates CVE-2026-73571 at 4.3 under CVSS 3.1.
Why the combination matters
Zimbra treats the account as the security boundary. These flaws cut across it: one authenticated account can read, impersonate and exfiltrate from others, and the two unpatched bugs help an outsider obtain that first account where external LDAP authentication is used.
A contested score
CVE-2026-73571 is rated differently depending on who you ask. Rapid7 gives it 8.3 High under CVSS 4.0. NVD's primary analysis rates it 4.3 Medium under CVSS 3.1 (network, low complexity, low privileges, low integrity impact only). The CVE's other submitter, MITRE, scored it 3.1 Low. The two figures use different CVSS versions, so they are not directly comparable, but the gap is wide enough that triage based on NVD alone would rank this bug low. NVD's record describes it as affecting versions before 10.1.17.
Disclosure timeline
Rapid7 reported 23 findings on 17 April 2026. Zimbra validated 10 on 21 May. ZCS 10.1.17 fixed CVE-2026-73571 on 28 May, and 10.1.20 fixed CVE-2026-10631, CVE-2026-50055 and CVE-2026-50054 on 20 July. Rapid7 filed a second report of 32 findings on 19 August and a third of 25 on 8 September. ZCS 10.1.21 fixed four findings on 24 September, when Rapid7 spoke at BruCON without releasing weaponized PoCs. Zimbra asked for 90 days from the later report before full details; Rapid7 scheduled those for 23 November.
What defenders should do
- Upgrade to the latest supported ZCS. At minimum 10.1.20 closes CVE-2026-73571, -10631 and -50055.
- Audit stored filter rules for external
notifyactions on every account. Upgrading does not remove existing rules, and the Modern Filters view will not show them. - For the unpatched pair, put a reverse proxy or WAF that inspects request bodies in front of GraphQL and flag anonymous requests with multiple
authenticatealiases. If you use external LDAP search-filter authentication, treat the domain as exposed. - Search EWS logs for operations involving two different account UUIDs.
- In incident response, check server-side state: EWS leaves no delegation grant to revoke, Sieve rules persist, and impersonated sends leave Sent-folder and MTA traces. Check every mailbox reached, not just the first compromised account.