Description

An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Classic recipient clicks Accept Share, allowing the attacker to access mailbox data and act as the victim.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.3",
  "pubDate": "2026-09-25T14:17:23.290Z",
  "pubdate": "2026-09-25T14:17:23.290Z",
  "executiveSummary": "This vulnerability is a Stored Cross-Site Scripting (XSS) flaw identified in Zimbra Classic.\nThe vulnerability allows an unauthenticated remote attacker to execute arbitrary JavaScript in the context of a victim's session.\nExploitation is triggered when an authenticated user interacts with a forged share notification by clicking 'Accept Share'.\nSuccessful exploitation grants the attacker the ability to hijack the victim's session, gain unauthorized access to mailbox data, and perform actions on behalf of the victim.\nThe vulnerability poses a severe risk to confidentiality and integrity, as it facilitates account takeover through malicious script execution.\nThere are no specific privilege requirements for the attacker to initiate the attack; however, the victim must be signed into the Zimbra Classic web interface for the malicious payload to execute upon interaction.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper sanitization and validation of user-supplied input within the share notification processing logic of Zimbra Classic. The system fails to adequately encode or filter malicious content embedded within the share request data before rendering it in the user's browser.\nThe attack flow begins with an unauthenticated attacker crafting a malicious share notification containing an XSS payload. This payload is injected into the fields processed by the notification engine. When the targeted victim, who must be authenticated, views the incoming share request, the malicious script remains dormant until the user interacts with the interface.\nThe exploitation occurs when the victim clicks the 'Accept Share' button. At this point, the application processes the tainted data, causing the browser to interpret and execute the attacker-supplied JavaScript. Because the script executes within the security context of the victim's authenticated session, the Same-Origin Policy (SOP) is bypassed, granting the script full access to the victim's session cookies, local storage, and the ability to perform authenticated API calls against the Zimbra server.\nThe vulnerable component is the share notification handling module within the Zimbra Classic web client. The payload is typically designed to exfiltrate session identifiers or perform unauthorized mailbox operations, such as forwarding emails, modifying account settings, or exfiltrating sensitive contact information. The lack of robust Content Security Policy (CSP) implementation or contextual output encoding at the point of ingestion and display allows the execution of this script.\nPost-exploitation, the attacker can maintain persistence or escalate access by leveraging the stolen session to act as the victim indefinitely. This constitutes a significant threat to organizational security, as the attacker can effectively masquerade as an internal user, leading to potential lateral movement, phishing campaigns directed at other users, or data breach events."
}