From One Account to Every Mailbox: Breaking Zimbra's Identity Boundaries (Part 1)
Rapid7 details dozens of Zimbra flaws, including mailbox impersonation and cross-user access, with some fixes still missing.
71
CVE-2026-50055
Sieve notify bypasses mail-forward policy in Zimbra
- CVSS 3.1
- 6.5 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CVE-2026-50055 is an incorrect-authorization flaw in Zimbra Collaboration Suite that lets an authenticated user evade a disabled mail-forwarding policy. The user creates a Sieve filter whose notify action sends copies of message content and headers to an address of their choosing, even though ordinary forwarding is turned off. Impact is confidentiality only: mail contents and headers can leave the organization; CVSS 3.1 rates it 6.5 (network, low privileges, no user interaction). Any Zimbra Collaboration deployment that relies on disabling user forwarding is affected; fixed versions are not stated in the provided data. It is not listed in CISA KEV, and no public proof-of-concept is known.
What to do: Apply the vendor fix for CVE-2026-50055 as soon as Zimbra publishes it for your release; the supplied data does not name a fixed version. Until then, review user Sieve scripts for notify actions that send mail content or headers off-box, and treat disabled mail-forwarding as unenforced. Alert on new or changed Sieve filters and on outbound messages to unexpected external addresses.
| Product | Affected |
|---|---|
| Zimbra Collaboration Suite | — |
Estimated exposure
large≈10,000–100,000 internet-exposed servers; mailbox users likely higher — Estimate only: Zimbra Collaboration is a widely deployed on-premises mail platform, and public internet scans have commonly shown on the order of tens of thousands of exposed Zimbra servers, each often hosting many mailboxes. No install…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A policy-enforcement flaw in Zimbra Collaboration Suite allows an authenticated user to bypass disabled mail forwarding by using a Sieve notify action to send copies of email content and headers to an arbitrary address.
- Weakness
- CWE-863
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N