Loading vulnerability…
Cross-user mailbox disclosure in Zimbra EWS FindItem
An authorization bypass in the EWS FindItem handler of Zimbra Collaboration Suite 10.1.0 through 10.1.19 allows an authenticated, EWS-enabled user to read other users' mailbox contents without sharing or delegation permissions. The handler trusts an attacker-selected owner UUID embedded in a composite folder identifier and constructs the authorization context from the selected mailbox rather than the authenticated caller. The flaw affects both local mailbox operations and requests forwarded to other servers within the same Zimbra cluster.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises mailbox confidentiality, exposing complete raw MIME messages, attachments, received messages, sent mail, drafts, contacts, and calendar entries belonging to other users. The confirmed vulnerability is limited to FindItem; it does not establish unauthorized GetItem, send, move, or delete capabilities. Rapid7 assigned a CVSS score of 6.5.
If you can’t patch tonight, do this now.
Pending upgrade, disable EWS for accounts that do not require it or restrict EWS access where operationally feasible. Review EWS logs for operations involving mailbox-owner UUIDs different from the authenticated account. Resetting a compromised account's password alone does not correct the authorization flaw or address previously disclosed mailbox data.
Patch, then assume compromise.
Upgrade Zimbra Collaboration Suite to version 10.1.20 or a later fixed release. Version 10.1.20 corrects EWS authorization-context construction to use the authenticated account for both local and remote mailbox operations. If exploitation is suspected, investigate cross-account EWS access and determine which mailboxes were exposed; no delegation grant is created by exploitation that can simply be revoked.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.