Rapid7 details five Zimbra flaws enabling password guessing, email impersonation, mailbox access and mail exfiltration

Oct 14, 2026 · Original article ↗

Summary

Rapid7 analyzes five Zimbra flaws that enable unauthenticated password guessing, sender impersonation, cross-user mailbox reads and persistent email exfiltration. Fixes are available for three; no public fix is listed for two.

Key points

A GraphQL authentication flaw bypasses Zimbra's source-IP failed-login counter, allowing batched password guesses; the article reports 10,000 candidates tested in under two minutes in one deployment.
A separate LDAP filter injection can expose an external-directory password oracle under a specific lazy-provisioning configuration and can combine with GraphQL to evade both IP and local-account lockouts.
An authenticated user can exploit SaveDraftRequest to send mail as another local user without send-as rights; Zimbra also saves the message in the impersonated user's Sent folder.
An EWS flaw lets an EWS-enabled account read other users' mail, attachments, drafts, contacts and calendar data by supplying a target mailbox identifier.
A Sieve notify policy bypass can send selected headers and message text to an external address, persisting after session expiry or a password change; it does not send attachments or raw MIME.
Zimbra fixed the impersonation flaw in ZCS 10.1.17 and the EWS and Sieve flaws in ZCS 10.1.20. Rapid7 lists no public fixed release for the two authentication-related flaws.
Rapid7 recommends upgrading to the latest supported release and checking stored incoming and outgoing filter rules for unauthorized notify actions; Modern's Filters view may not show them.

Article Details

Attack Vectors: An unauthenticated user can batch password guesses through Zimbra Modern's GraphQL authenticate mutation at /service/extension/graphql, bypassing the source-IP failed-login counter. In the stated external-LDAP and lazy auto-provisioning configuration, CVE-2026-93635 can also make authentication responses distinguish a correct directory password.
An ordinary authenticated user can exploit CVE-2026-73571 through SaveDraftRequest to send a message as another local user without send-as authorization; Zimbra also records the message in that user's Sent folder.
An EWS-enabled account can exploit CVE-2026-10631 by supplying another user's UUID in a composite folder ID, allowing FindItem to read that user's mailbox items and folders.
An authenticated user can exploit CVE-2026-50055 to install a Sieve notify rule that sends selected message headers and text bodies to an external address, bypassing a policy that disables mail forwarding in filters.
Defensive Notes: Apply ZCS 10.1.17 or later to address CVE-2026-73571, and ZCS 10.1.20 or later to address CVE-2026-10631 and CVE-2026-50055. The article reports no publicly listed fixed release for CVE-2026-93635 or CVE-2026-93637 at publication.
Inspect stored incoming and outgoing filter rules for external notify and RFC-compliant notify actions that violate forwarding policy; the article notes that Modern's Filters view may not display these rules.
Review EWS logs for cross-user operations involving different account UUIDs, and inspect saved notify rules and outbound notification traffic for evidence of Sieve-based exfiltration.
A reverse proxy or web application firewall that inspects request bodies can look for multiple authenticate aliases in a single anonymous GraphQL request.