---
id: CVE-2026-93639
title: >-
  Zimbra Collaboration Suite Missing Authorization in ConfigureZimlet Enables
  Delegated Administrator Privilege Escalation
summary: >-
  A missing authorization vulnerability in Zimbra Collaboration Suite (ZCS)
  allows a delegated administrator with no explicit administrative grants to
  overwrite global Zimlet configuration through ConfigureZimletRequest. The
  uploaded confi…
severity: high
cvss: 8.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-862
vendor: Zimbra
product: Zimbra Collaboration Suite
affected:
  - collaboration_suite <= 10.1.20
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T13:29:25.939Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-93639'
references:
  - url: 'https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories'
  - url: >-
      https://www.rapid7.com/blog/post/ve-breaking-zimbra-identity-boundaries-part-1/
tags:
  - cve.org
ingestedAt: '2026-10-23T14:28:08.707Z'
---

## Overview

A missing authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows a delegated administrator with no explicit administrative grants to overwrite global Zimlet configuration through ConfigureZimletRequest. The uploaded configuration can also add an attacker-controlled domain to the proxy allowlist of the default class of service. If a signed-in user in that class opens a crafted /service/proxy URL, Zimbra serves attacker-controlled HTML under its own origin. The resulting JavaScript can read mailbox data and perform authenticated actions as the victim. Exploitation requires a delegated-administrator account and access to the admin SOAP service; the browser compromise additionally requires the victim to open the crafted URL. ZCS 10.1.16 and 10.1.20 are affected.

## Affected

- `collaboration_suite <= 10.1.20`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.