CVE-2026-73571
Received Received - Intake

Authorization Bypass in Zimbra Collaboration via SOAP Request

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: MITRE

Description
An authorization bypass vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.17 due to improper authorization validation in delegated email sending functionality. An authenticated attacker can send specially crafted SOAP requests to impersonate another user and send emails without possessing the required delegation or send-as permissions. This occurs in the SaveDraftRequest SOAP handler.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-73571
EUVD
EUVD-2026-58070

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
zimbra collaboration to 10.1.17 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an authorization bypass vulnerability in Zimbra Collaboration (ZCS) before version 10.1.17. It allows an authenticated attacker to send emails impersonating another user without proper delegation or send-as permissions by exploiting improper authorization validation in the SaveDraftRequest SOAP handler.

Impact Analysis

An attacker could send emails on your behalf, potentially tricking recipients into disclosing sensitive information or performing unauthorized actions. This could lead to reputational damage, data breaches, or further compromise of your account or systems.

Mitigation Strategies

Upgrade Zimbra Collaboration to version 10.1.17 or later to address the authorization bypass vulnerability in the SaveDraftRequest SOAP handler.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73571. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart