CVE-2026-33373
CSRF Vulnerability in Zimbra Web Client Enables Account Takeover
Publication date: 2026-03-30
Last updated on: 2026-04-07
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| synacor | zimbra_collaboration_suite | From 10.0.0 (inc) to 10.0.18 (exc) |
| synacor | zimbra_collaboration_suite | From 10.1.0 (inc) to 10.1.13 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Cross-Site Request Forgery (CSRF) issue found in Zimbra Collaboration (ZCS) versions 10.0 and 10.1. It occurs because authentication tokens are issued without CSRF protection during certain account state changes, such as enabling two-factor authentication or changing a password.
While such a token is active, authenticated SOAP requests that cause token generation or state changes can be made without CSRF validation. An attacker could exploit this by tricking a victim into submitting crafted requests, potentially allowing the attacker to perform sensitive actions like disabling two-factor authentication on the victim's account.
The vulnerability is addressed by ensuring that CSRF protection is consistently applied to all issued authentication tokens.
How can this vulnerability impact me? :
This vulnerability can allow an attacker to perform unauthorized sensitive actions on a victim's account without their consent. For example, an attacker could disable two-factor authentication by exploiting the lack of CSRF protection on authentication tokens.
Such unauthorized actions could weaken account security, potentially leading to account compromise or unauthorized access to sensitive information.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, ensure that CSRF protection is consistently enforced for all issued authentication tokens, especially those generated after operations such as enabling two-factor authentication or changing a password.