AI analysis
CVE-2026-10631 is an authorization bypass (CWE-639) in the EWS FindItem handler of Zimbra Collaboration Suite 10.1.0 through 10.1.19. An authenticated user who already has EWS enabled can request mailbox items belonging to arbitrary local accounts without a share or delegation grant. The flaw returns complete items, including raw MIME and attachments, so confidentiality impact is high while integrity and availability are not affected (CVSS 3.1 base 6.5). Organizations running that 10.1 range, especially multi-user mail servers, are in scope. It is not listed in CISA KEV and no public proof-of-concept is known.
What to do: Upgrade Zimbra Collaboration Suite 10.1 past 10.1.19 to the vendor’s patched release (confirm the exact fixed build in Zimbra’s advisory; do not assume a version number). Until then, restrict which accounts have EWS enabled and review logs for unexpected FindItem or cross-mailbox reads.
Affected
| Zimbra Collaboration Suite | 10.1.0 through 10.1.19 |
Estimated exposure
moderatethousands to low tens of thousands of Zimbra 10.1 servers (estimate) — Public internet scans have historically shown on the order of tens of thousands of reachable Zimbra web interfaces worldwide, but only the 10.1.0–10.1.19 line is affected and many deployments are internal or on other branches, so the…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
An authorization bypass in the EWS FindItem handler of Zimbra Collaboration Suite 10.1.0 through 10.1.19 allows an authenticated user with EWS enabled to read complete mailbox items, including raw MIME and attachments, from arbitrary local accounts without a share or delegation grant.