Description

An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Modern recipient clicks Accept Share, allowing the attacker to access mailbox data and act as the victim.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.3",
  "pubDate": "2026-09-25T14:17:23.423Z",
  "pubdate": "2026-09-25T14:17:23.423Z",
  "executiveSummary": "This vulnerability involves a stored Cross-Site Scripting (XSS) flaw within the Zimbra Modern web interface, stemming from improper neutralization of user-supplied data in share notifications. An unauthenticated remote attacker can exploit this by crafting a malicious share notification that, when viewed by an authenticated recipient, executes arbitrary JavaScript in the victim's browser session. The primary impact includes full account compromise, unauthorized access to sensitive mailbox data, and the ability to perform actions on behalf of the victim, such as sending unauthorized emails or modifying security settings. Exploitation is facilitated by the victim interacting with the malicious notification via the 'Accept Share' functionality. The flaw highlights a failure in input sanitization or output encoding mechanisms within the notification handling component of the Zimbra Modern UI, posing a significant risk to organizational communication integrity and data confidentiality.",
  "technicalDetails": "The vulnerability resides in the Zimbra Modern web application's handling of share notification objects. When a share request is initiated, the application processes notification parameters that are rendered in the victim's interface upon arrival. The flaw manifests because the application fails to adequately sanitize or encode malicious payloads injected into these notification fields before they are stored in the backend or rendered in the recipient's browser context.\nThe attack flow begins with an unauthenticated attacker injecting a crafted payload into the share notification mechanism. Because the system does not enforce strict origin or authenticity validation for these notifications, the malicious object is accepted and persisted by the server. When the targeted user logs into the Zimbra Modern interface, the system retrieves the notification data to display the pending share request. Upon the user navigating to the 'Accept Share' dialogue, the application incorrectly interprets the malicious payload as executable code rather than plain text within the DOM.\nThis triggers the execution of JavaScript in the context of the victim's session. Since the script executes within the authenticated user's origin, it can bypass standard browser protections, allowing the attacker to perform several post-exploitation activities. Specifically, the payload can be designed to steal session cookies, exfiltrate private messages, modify mailbox configurations, or perform background requests to the Zimbra API to propagate the attack or exfiltrate data to an attacker-controlled external domain.\nThe root cause is an improper neutralization of input during the notification rendering process, specifically related to the lack of context-aware output encoding in the Modern UI component responsible for processing share events. The lack of robust Content Security Policy (CSP) implementation or restrictive input validation allows the injected script to persist until the victim interacts with the notification. This vulnerability requires no prior authentication from the attacker, effectively leveraging the trust relationship between the mail server and the end-user interface to facilitate a successful XSS attack."
}