---
id: CVE-2026-93631
title: >-
  Zimbra Collaboration Suite OAuth Extension Cross-Site Request Forgery Enables
  Account Linking
summary: >-
  A cross-site request forgery vulnerability in the OAuth extension of Zimbra
  Collaboration Suite (ZCS) Network Edition allows an attacker to link an
  attacker-controlled external account to a victim's mailbox. The OAuth callback
  does not b…
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-352
vendor: Zimbra
product: Zimbra Collaboration Suite
affected:
  - collaboration_suite <= 10.1.20
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T13:23:34.952Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-93631'
references:
  - url: 'https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories'
  - url: >-
      https://www.rapid7.com/blog/post/ve-breaking-zimbra-identity-boundaries-part-1/
tags:
  - cve.org
ingestedAt: '2026-10-23T14:28:08.712Z'
---

## Overview

A cross-site request forgery vulnerability in the OAuth extension of Zimbra Collaboration Suite (ZCS) Network Edition allows an attacker to link an attacker-controlled external account to a victim's mailbox. The OAuth callback does not bind its state value or authorization code to the initiating Zimbra session and instead selects the destination mailbox from the browser's current authentication cookie. On a deployment with the provider configured, an attacker can induce a signed-in victim to load a callback containing a fresh code for the attacker's provider account. This creates a persistent data source that imports attacker-controlled contacts or events. With bidirectional CalDAV synchronization, appointments subsequently created or edited in the linked calendar are also disclosed to the attacker. ZCS 10.1.16 and 10.1.20 are affected.

## Affected

- `collaboration_suite <= 10.1.20`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.