Loading vulnerability…
Persistent Mailbox Delegation Authorization Bypass in Zimbra Collaboration Suite
CVE-2026-50054 is an authorization flaw in Zimbra Collaboration Suite's GrantRightsRequest operation. An attacker with access to an authenticated account can improperly grant another local account the loginAs right, establishing persistent mailbox access and mail-sending authority. The delegated rights survive password changes and session expiration. Zimbra Collaboration Suite 10.1.20 fixes the vulnerability.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Unauthorized mailbox delegation compromises email confidentiality and enables mail sending through the affected mailbox. Because the loginAs grant persists independently of the original authenticated session, changing the affected account's password or expiring its sessions does not eliminate the delegated access.
If you can’t patch tonight, do this now.
Review existing loginAs delegation grants and revoke unauthorized rights. Investigate mailbox access and mail-sending activity involving affected accounts. No vendor-provided workaround is identified; grant review and revocation are defensive measures, not substitutes for patching.
Patch, then assume compromise.
Upgrade to Zimbra Collaboration Suite 10.1.20 or a later release containing the fix. As part of incident recovery, identify and revoke unauthorized loginAs grants and investigate the accounts involved. Do not treat password resets or session expiration alone as sufficient recovery.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.