Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
CVE-2026-93628: Zimbra Collaboration Suite lets attacker fake meeting replies
CVE-2026-93628 · published 12 days ago
Summary
In Zimbra Collaboration Suite versions 10.1.16 and 10.1.21, an email that looks like a calendar reply can be sent by anyone who knows the meeting details. This lets the sender change an attendee's response status in the organizer's calendar without any approval. Update Zimbra to the latest patched version or apply the vendor's recommended fix to stop the unauthorized changes.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| zimbra | zimbra collaboration suite | <= 10.1.21 |
Original advisory text
Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar REPLY Attendee Response
An attendee authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to forge another attendee's response to an existing meeting. Zimbra passes a null sender identity when processing iCalendar REPLY components, causing the attendee authorization filter to be skipped. An attacker who knows the meeting UID, organizer address and attendee address can send a non-outdated reply that changes the attendee's participation status in the organizer's calendar. The change occurs automatically during delivery without organizer or attendee interaction. ZCS 10.1.16 and 10.1.21 are affected.
References
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-290Authentication Bypass by Spoofing
Timeline
Published23 Oct 2026
Updated4 Nov 2026
First seen23 Oct 2026
Track software like this
Free during beta