CVE-2026-93630

A hostname canonicalization vulnerability in the email HTML sanitizers of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to bypass the restriction on forms that target the Zimbra host. DefangFilter and the OWASP ActionAttributePolicy compare the form-action hostname with the request hostname before browser URL canonicalization. A percent-encoded hostname can therefore survive sanitization while the browser submits the form to the normal Zimbra origin with the recipient's authentication cookie. This permits authenticated form requests from a crafted email after the recipient opens it in Classic and submits the form. The issue is present in ZCS 10.1.16 and 10.1.21. It does not bypass an endpoint's CSRF-token checks; a state-changing attack additionally requires an endpoint that accepts the resulting request without that protection.

• CWE-180

• https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
• https://www.rapid7.com/blog/post/ve-breaking-zimbra-identity-boundaries-part-1/

Published

Oct 23, 2026

Last Modified

Oct 28, 2026

Status

Undergoing Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-93623Unauthenticated Insecure Direct Object References (IDOR) in …5.3
• CVE-2026-93624Shop manager PHP Object Injection in Music Player for WooCom…7.2
• CVE-2026-93627An organizer authentication vulnerability in the email calen…5.3
• CVE-2026-93628An attendee authentication vulnerability in the email calend…5.3
• CVE-2026-93629An organizer authentication vulnerability in Zimbra Collabor…5.3
• CVE-2026-9363A vulnerability was detected in Edimax EW-7438RPn 1.12. This…6.3
• CVE-2026-93631A cross-site request forgery vulnerability in the OAuth exte…7.1
• CVE-2026-93633A CSS sanitization vulnerability in Zimbra Collaboration Sui…5.4
• CVE-2026-93634A cross-account authorization vulnerability in Zimbra Collab…4.3
• CVE-2026-93635LDAP filter injection in Zimbra Collaboration Suite 10.1.0 t…5.3
• CVE-2026-93636An LDAP filter injection vulnerability in Zimbra Collaborati…4.3
• CVE-2026-93637An authentication rate-limit bypass in Zimbra Collaboration …3.7