CVE-2026-33372

An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A cross-site request forgery (CSRF) vulnerability exists in Zimbra Webmail due to improper validation of CSRF tokens. The application accepts CSRF tokens supplied within the request body instead of requiring them through the expected request header. An attacker can exploit this issue by tricking an authenticated user into submitting a crafted request. This may allow unauthorized actions to be performed on behalf of the victim.

• CWE-352

• https://wiki.zimbra.com/wiki/Security_CenterRelease Notes, Vendor Advisory
• https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.16#Security_FixesRelease Notes
• https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_PolicyProduct
• https://wiki.zimbra.com/wiki/Zimbra_Security_AdvisoriesVendor Advisory

Published

Mar 20, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33366Missing authentication for critical function vulnerability i…6.9
• CVE-2026-33368Zimbra Collaboration Suite (ZCS) 10.0 and 10.1 contains a re…6.1
• CVE-2026-33369Zimbra Collaboration (ZCS) 10.0 and 10.1 contains an LDAP in…4.3
• CVE-2026-3337Observable timing discrepancy in AES-CCM decryption in AWS-L…8.2
• CVE-2026-33370An issue was discovered in Zimbra Collaboration (ZCS) 10.0 a…6.1
• CVE-2026-33371An issue was discovered in Zimbra Collaboration (ZCS) 10.0 a…4.3
• CVE-2026-33373An issue was discovered in Zimbra Collaboration (ZCS) 10.0 a…8.8
• CVE-2026-33375The Grafana MSSQL data source plugin contains a logic flaw t…6.5
• CVE-2026-33376When using an IPv6 allow-list for the Auth Proxy feature, it…7.4
• CVE-2026-33377An Editor can overwrite a dashboard not owned by them to acq…7.1
• CVE-2026-33378Using the $__timeGroup macro, one can achieve an OOM by over…6.5
• CVE-2026-3338Improper signature validation in PKCS7_verify() in AWS-LC al…8.7