CVE-2026-50054
Received Received - Intake

Authorization Bypass in Zimbra Collaboration Suite

Publication date: 2026-10-08

Last updated on: 2026-10-08

Assigner: Rapid7, Inc.

Description
An authorization flaw in Zimbra Collaboration Suite’s GrantRightsRequest allows an attacker with access to an authenticated account to grant another local account the loginAs right, creating persistent mailbox access and mail-sending authority that survives password changes and session expiry.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-08
Last Modified
2026-10-08
Generated
2026-10-08
AI Q&A
2026-10-08
EPSS Evaluated
N/A
NVD
CVE-2026-50054
EUVD
EUVD-2026-95097

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Zimbra Zimbra Collaboration Suite 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authorization flaw in Zimbra Collaboration Suite’s GrantRightsRequest feature. An attacker with access to an authenticated account can grant another local account the loginAs right, allowing persistent mailbox access and mail-sending authority. This access remains even after password changes or session expiry.

Impact Analysis

An attacker could gain unauthorized access to your mailbox, read sensitive emails, send emails on your behalf, or maintain long-term access even if you change passwords. This could lead to data breaches, reputational damage, or further compromise of your account.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized access to sensitive data, leading to potential breaches of GDPR (data protection) or HIPAA (health information privacy). Organizations may face legal penalties, fines, or reputational harm if such breaches occur.

Mitigation Strategies

Apply the latest Zimbra Collaboration Suite security patches immediately to address the authorization flaw in GrantRightsRequest. Review and restrict local account permissions to prevent unauthorized grant of loginAs rights. Monitor mailbox access logs for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-50054. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart