UpHeron
All vulnerabilities

Servers and applications

CVE-2026-50053

Zimbra Collaboration Suite RestFilter Request Attribute Override via Unauthenticated URL Parameters

Severity
Medium 5.4
Published
23 Oct 2026
Last changed
2 Nov 2026
Added to UpHeron
3 Nov 2026
Sources
NVD, CVE Program

Description

A request attribute override vulnerability in Zimbra Collaboration Suite (ZCS) allows unauthenticated requests to /h/* to populate servlet attributes intended for trusted internal dispatch. RestFilter copies URL parameters specifying an authentication token, target account, target item and dispatch state into the request attributes consumed by the Classic Web Client. Combined with CVE-2026-10632…

Affected software

SoftwareAffected versions
Zimbra CollaborationServers and applications · cna:zimbra|zimbra collaboration suite
  • Every version up to 10.1.17
Zimbra CollaborationServers and applications · cpe:a:synacor:zimbra_collaboration_suite
  • Every version up to 10.1.17

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-50053
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-50053