CVE-2026-50054 — Zimbra Collaboration Suite GrantRightsRequest SOAP Handler Allows Self-Granting of Undocumented loginAs Mailbox Deleg…

CVE-2026-50054

Zimbra Collaboration Suite GrantRightsRequest SOAP Handler Allows Self-Granting of Undocumented loginAs Mailbox Delegation Right PUBLISHED

Description (CNA)

An authorization flaw in Zimbra Collaboration Suite’s GrantRightsRequest allows an attacker with access to an authenticated account to grant another local account the loginAs right, creating persistent mailbox access and mail-sending authority that survives password changes and session expiry.

Affected (CNA)

Vendor / product	Versions
Zimbra / Zimbra Collaboration Suite	affected 0 before 10.1.20

CWE

CWE-269

References

https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.