CVE-2026-10631
Received Received - Intake

Authorization Bypass in Zimbra Collaboration Suite EWS

Publication date: 2026-10-08

Last updated on: 2026-10-08

Assigner: Rapid7, Inc.

Description
An authorization bypass in the EWS FindItem handler of Zimbra Collaboration Suite 10.1.0 through 10.1.19 allows an authenticated user with EWS enabled to read complete mailbox items, including raw MIME and attachments, from arbitrary local accounts without a share or delegation grant.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-08
Last Modified
2026-10-08
Generated
2026-10-08
AI Q&A
2026-10-08
EPSS Evaluated
N/A
NVD
CVE-2026-10631
EUVD
EUVD-2026-95096

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Zimbra Zimbra Collaboration Suite 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authorization bypass in the EWS FindItem handler of Zimbra Collaboration Suite versions 10.1.0 through 10.1.19. It allows an authenticated user with EWS enabled to access and read complete mailbox items, including raw MIME and attachments, from any local account without requiring a share or delegation grant.

Impact Analysis

An attacker with valid credentials could exploit this flaw to read sensitive emails, attachments, or other mailbox data from other users on the same system. This could lead to unauthorized access to confidential information, data breaches, or privacy violations.

Compliance Impact

This vulnerability could lead to non-compliance with data protection regulations like GDPR or HIPAA by enabling unauthorized access to personal or sensitive data. Organizations may face legal penalties, reputational damage, and loss of customer trust if such breaches occur.

Mitigation Strategies

Update Zimbra Collaboration Suite to a version that patches this authorization bypass vulnerability. Disable EWS access for users if not required. Review mailbox permissions to ensure no unauthorized access is possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-10631. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart