CVE-2026-93628
Last modified
CVE-2026-93628 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. An attendee authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to forge another attendee's response to an existing meeting. Zimbra passes a null sender identity when processing iCalendar REPLY components, causing the attendee authorization filter to be skipped. EPSS estimates a 0.27% chance of exploitation in the next 30 days.
Description
An attendee authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to forge another attendee's response to an existing meeting. Zimbra passes a null sender identity when processing iCalendar REPLY components, causing the attendee authorization filter to be skipped. An attacker who knows the meeting UID, organizer address and attendee address can send a non-outdated reply that changes the attendee's participation status in the organizer's calendar. The change occurs automatically during delivery without organizer or attendee interaction. ZCS 10.1.16 and 10.1.21 are affected.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Zimbra | Zimbra Collaboration Suite | <= 10.1.21 |
References
Timeline
- Published
- Last Modified
- Status
- Undergoing Analysis
Frequently Asked Questions
What is CVE-2026-93628?
How severe is CVE-2026-93628?
How do I fix CVE-2026-93628?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-93620Unauthenticated Broken Access Control in PayPlus Payment Gat…6.5
- CVE-2026-93621Unauthenticated SQL Injection in WP Data Access <= 5.5.84 ve…8.2
- CVE-2026-93622Unauthenticated Cross Site Scripting (XSS) in WPS Limit Logi…7.1
- CVE-2026-93623Unauthenticated Insecure Direct Object References (IDOR) in …5.3
- CVE-2026-93624Shop manager PHP Object Injection in Music Player for WooCom…7.2
- CVE-2026-93627An organizer authentication vulnerability in the email calen…5.3
- CVE-2026-93629An organizer authentication vulnerability in Zimbra Collabor…5.3
- CVE-2026-9363A vulnerability was detected in Edimax EW-7438RPn 1.12. This…6.3
- CVE-2026-93630A hostname canonicalization vulnerability in the email HTML …4.3
- CVE-2026-93631A cross-site request forgery vulnerability in the OAuth exte…7.1
- CVE-2026-93633A CSS sanitization vulnerability in Zimbra Collaboration Sui…5.4
- CVE-2026-93634A cross-account authorization vulnerability in Zimbra Collab…4.3
Are you affected by CVE-2026-93628?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST