UpHeron
All vulnerabilities

Servers and applications

CVE-2025-32354

In Zimbra Collaboration (ZCS) 9.0 through 10.1, a Cross-Site Request Forgery (CSRF) vulnerability exists in the GraphQL endpoint (/service/extension/graphql) of Zimbra webmail due to a lack of CSRF token validation. This allows attackers to perform unauthorized GraphQL operations, such as modifying contacts, changing account settings, and accessing sensitive user data when an authenticated user…

Severity
High 8.8
Published
29 Apr 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
10.1.4
Sources
NVD

Affected software

SoftwareAffected versions
Zimbra CollaborationServers and applications · cpe:a:synacor:zimbra_collaboration_suite
  • From 9.0.0 before 10.1.4

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-32354
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-32354