CVE-2026-33372

Vulnerability

Overview

A cross-site request forgery (CSRF) vulnerability exists in Zimbra Collaboration (ZCS) versions 10.0 and 10.1. The root cause is improper validation of CSRF tokens: the application accepts tokens supplied within the request body instead of requiring them through the expected request header [1][2]. This flaw allows an attacker to craft a malicious request that, when submitted by an authenticated user, is processed as legitimate.

Exploitation

To exploit this vulnerability, an attacker must trick an authenticated Zimbra Webmail user into submitting a crafted request, for example via a malicious link or a cross-site scripting payload. No additional authentication is required beyond the victim's active session. The attack surface is the webmail interface, where CSRF tokens are expected to protect state-changing operations.

Impact

Successful exploitation enables an attacker to perform unauthorized actions on behalf of the victim, such as modifying account settings, sending emails, or deleting messages. The CVSS v3 base score is 5.4 (Medium), reflecting the need for user interaction and the potential for partial integrity impact.

Mitigation

Zimbra addressed this issue in ZCS version 10.1.16, released on February 4, 2026 [3]. The fix ensures CSRF tokens are validated only when provided via the expected request header. Users are advised to upgrade to the latest supported release. The vulnerability disclosure policy [4].