Description

An authorization bypass vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.17 due to improper authorization validation in delegated email sending functionality. An authenticated attacker can send specially crafted SOAP requests to impersonate another user and send emails without possessing the required delegation or send-as permissions. This occurs in the SaveDraftRequest SOAP handler.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.1",
  "pubDate": "2026-08-13T16:19:06.150Z",
  "pubdate": "2026-08-13T16:19:06.150Z",
  "executiveSummary": "An authorization bypass vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.17, specifically residing within the delegated email sending functionality.\nThe vulnerability allows an authenticated attacker to execute unauthorized actions, specifically enabling the impersonation of arbitrary users to transmit emails without possessing the necessary cryptographic or administrative delegation and send-as permissions.\nThe flaw manifests due to improper authorization validation enforced by the affected SOAP handler, leading to a breakdown in access control boundaries within multi-user collaboration environments.\nThe risk implication is significant, as it undermines message integrity, enables sophisticated phishing or social engineering campaigns originating from trusted internal identities, and violates core security principles of least privilege and authentication segregation.\nExploitation of this vulnerability requires authentication to the Zimbra Collaboration platform and the capability to transmit specially crafted SOAP requests to the backend server.\nImpacted systems include all Zimbra Collaboration (ZCS) deployments running versions prior to 10.1.17.",
  "technicalDetails": "The root cause of the vulnerability stems from improper authorization validation within the delegated email sending logic of Zimbra Collaboration (ZCS).\nSpecifically, the vulnerability is localized to the SaveDraftRequest SOAP handler, which processes requests associated with draft creation and message transmission workflows.\nUnder normal operating conditions, the application should verify that the authenticated session initiator possesses explicit delegation rights or send-as permissions for the target mailbox before permitting message composition or transmission on behalf of another user.\nHowever, due to insufficient validation checks within the SaveDraftRequest SOAP handler, these prerequisite permission verifications are inadequately enforced.\nThe attack flow proceeds as follows: an authenticated attacker initializes a session within the Zimbra Collaboration environment. The attacker then constructs a specially crafted SOAP payload targeting the SaveDraftRequest handler.\nWithin this SOAP payload, the attacker manipulates parameters to specify an arbitrary victim user as the sender or originator of the message, bypassing the access control checks that normally restrict such actions to authorized delegates.\nUpon receiving the malicious SOAP request, the vulnerable SaveDraftRequest handler processes the transaction without validating whether the authenticated user holds legitimate send-as or delegation privileges for the specified account.\nThe application subsequently accepts the request, allowing the attacker to successfully forge email communications originating from the victim's identity.\nAffected versions comprise all Zimbra Collaboration (ZCS) software iterations predating version 10.1.17.\nAuthentication requirements dictate that the attacker must possess a valid user session within the target Zimbra Collaboration instance, meaning anonymous exploitation is generally precluded unless initial access has already been secured.\nPrivilege requirements are low from an account perspective, as standard authenticated users can initiate the attack, but the vulnerability yields high impact by elevating effective capabilities regarding email transmission across foreign accounts.\nNetwork exposure involves SOAP endpoints utilized by the Zimbra Collaboration architecture, which are typically accessible over standard HTTP/HTTPS ports exposed to authenticated clients.\nThe post-exploitation impact includes the potential generation of highly convincing internal or external spear-phishing campaigns, unauthorized data dissemination, reputation damage, and complete compromise of email non-repudiation assurances within the affected messaging ecosystem."
}