CVE-2026-50054 Zimbra CVE debrief

Who should care

Defenders responsible for Zimbra Collaboration Suite deployments should assess exposure and verify mailbox delegation settings to prevent unauthorized access. This includes verifying mailbox delegation settings, monitoring for suspicious loginAs activity, and reviewing and updating Zimbra Collaboration Suite to version 10.1.20 or later. Additionally, defenders should prioritize verifying mailbox delegation settings and monitoring for suspicious loginAs

Why it matters

The authorization flaw in Zimbra Collaboration Suite's GrantRightsRequest SOAP handler allows an attacker to grant another local account the loginAs right, creating persistent mailbox access and mail-sending authority. Defenders responsible for Zimbra Collaboration Suite deployments should assess exposure and verify mailbox delegation settings to prevent unauthorized access. The impact of this vulnerability is significant, as it can lead to unauthorized access to sensitive information and disruption of mail services.

• Defenders must verify mailbox delegation settings to prevent unauthorized access.
• Monitoring for suspicious loginAs activity is necessary to detect potential exploitation.
• Zimbra Collaboration Suite versions prior to 10.1.20 require remediation to address the vulnerability.

Technical summary

An authorization flaw in Zimbra Collaboration Suite's GrantRightsRequest SOAP handler allows an attacker with access to an authenticated account to grant another local account the loginAs right, creating persistent mailbox access and mail-sending authority that survives password changes and session expiry. The flaw is due to inadequate validation of the GrantRightsRequest SOAP handler, which enables an attacker to self-grant the loginAs right. This vulnerability affects Zimbra Collaboration Suite versions prior to 10.1.20.

Defensive priority

Defenders should prioritize verifying mailbox delegation settings and monitoring for suspicious loginAs activity.

Recommended defensive actions

• Verify mailbox delegation settings to prevent unauthorized access.
• Monitor for suspicious loginAs activity to detect potential exploitation.
• Review and update Zimbra Collaboration Suite to version 10.1.20 or later.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and source item provide details on the authorization flaw in Zimbra Collaboration Suite's GrantRightsRequest SOAP handler. The flaw allows an attacker to grant another local account the loginAs right, creating persistent mailbox access and mail-sending authority. The source item provides additional context on the vulnerability, including its potential impact on Zimbra Collaboration Suite deployments. Defenders should verify mailbox delegation settings and monitor for suspicious loginAs activity to detect potential The

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.