CVE-2026-93629
Last modified
CVE-2026-93629 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. An organizer authentication vulnerability in Zimbra Collaboration Suite (ZCS) allows an unauthenticated email sender to insert calendar invitations attributed to another user. The email delivery path permits external invitations but does not verify that the message sender is authorized to use the iCalendar ORGANIZER identity. EPSS estimates a 0.27% chance of exploitation in the next 30 days.
Description
An organizer authentication vulnerability in Zimbra Collaboration Suite (ZCS) allows an unauthenticated email sender to insert calendar invitations attributed to another user. The email delivery path permits external invitations but does not verify that the message sender is authorized to use the iCalendar ORGANIZER identity. When automatic invitation insertion is enabled, a crafted REQUEST component creates an event containing attacker-selected meeting details and reminders under a forged organizer without recipient interaction. No corresponding event is created in the claimed organizer's calendar. ZCS 10.1.16 and 10.1.21 are affected.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Zimbra | Zimbra Collaboration Suite | <= 10.1.21 |
References
Timeline
- Published
- Last Modified
- Status
- Undergoing Analysis
Frequently Asked Questions
What is CVE-2026-93629?
How severe is CVE-2026-93629?
How do I fix CVE-2026-93629?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-93621Unauthenticated SQL Injection in WP Data Access <= 5.5.84 ve…8.2
- CVE-2026-93622Unauthenticated Cross Site Scripting (XSS) in WPS Limit Logi…7.1
- CVE-2026-93623Unauthenticated Insecure Direct Object References (IDOR) in …5.3
- CVE-2026-93624Shop manager PHP Object Injection in Music Player for WooCom…7.2
- CVE-2026-93627An organizer authentication vulnerability in the email calen…5.3
- CVE-2026-93628An attendee authentication vulnerability in the email calend…5.3
- CVE-2026-9363A vulnerability was detected in Edimax EW-7438RPn 1.12. This…6.3
- CVE-2026-93630A hostname canonicalization vulnerability in the email HTML …4.3
- CVE-2026-93631A cross-site request forgery vulnerability in the OAuth exte…7.1
- CVE-2026-93633A CSS sanitization vulnerability in Zimbra Collaboration Sui…5.4
- CVE-2026-93634A cross-account authorization vulnerability in Zimbra Collab…4.3
- CVE-2026-93635LDAP filter injection in Zimbra Collaboration Suite 10.1.0 t…5.3
Are you affected by CVE-2026-93629?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST