NewsRapid7
From One Account to Every Mailbox: Breaking Zimbra's Identity Boundaries (Part 1)
Linked advisories
- CVE-2026-93635Zimbra Collaboration Suite: LDAP-Injection
- CVE-2026-50055Zimbra Collaboration Suite: fehlerhafte Autorisierung
- CVE-2026-10631Synacor Zimbra: Mehrere Schwachstellen
- CVE-2026-50055Zimbra Collaboration Suite: fehlerhafte Autorisierung
- CVE-2026-50054Synacor Zimbra: unzureichende Rechteverwaltung
- CVE-2026-50054Synacor Zimbra: unzureichende Rechteverwaltung
- CVE-2026-93635Zimbra Collaboration Suite: LDAP-Injection
- CVE-2026-93637Zimbra Collaboration Suite: fehlende Begrenzung von Anmeldeversuchen
- CVE-2026-10631Zimbra Collaboration Suite: Umgehung der Autorisierung über nutzergesteuerten Schlüssel
- CVE-2026-10631Zimbra Collaboration Suite: Umgehung der Autorisierung über nutzergesteuerten Schlüssel
- CVE-2026-93637Zimbra Collaboration Suite: fehlende Begrenzung von Anmeldeversuchen
- CVE-2026-73571Synacor Zimbra: Mehrere Schwachstellen
- CVE-2026-73571Zimbra Collaboration: fehlerhafte Autorisierung
- CVE-2026-93635Synacor Zimbra: Mehrere Schwachstellen
- CVE-2026-73571Zimbra Collaboration: fehlerhafte Autorisierung
Affected vendors and products
More on Account
Other advisories
- HighCVE-2026-118045Ever Accounting: externe Kontrolle von Dateinamen oder -pfaden
- HighCVE-2026-118045Ever Accounting: externe Kontrolle von Dateinamen oder -pfaden
- CriticalCVE-2026-117691Keycloak SAML redirect-binding signature bypass lets attackers take over federated accounts (CVE-2026-117691)
- HighCVE-2026-123158Alpine Linux sshd password authentication bypass lets anyone log in to key-only accounts (CVE-2026-123158)
- MediumCVE-2026-99226keys: Avoid the owner account dereference in named keyring lookup
- Not ratedosv:CVE-2026-121735blueprintUE Self-Hosted Edition before 4.3.4 Non-Expiring Account Confirmation Tokens
- Not ratedosv:CVE-2026-121628Bagisto before 2.3.16 and 2.4.x before 2.4.1 Race Condition in Coupon Usage Accounting
- HighCVE-2026-119215AshAuthentication TOTP setup lets a user install their own authenticator secret on another user's account
Other news entries
- Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on HoneypotNewsThe Hacker News
- DigiCert Data Breach Impacts Business Customer InformationNewsSecurityWeek
- OpenSSH Rushes Patches for ‘SSHole’ Authentication BypassNewsSecurityWeek
- 3 Charged in Scheme to Use AI to Impersonate CEOs and Attorneys to Steal $129 MillionNewsSecurityWeek
- OpenSSH flaw lets attackers access password-disabled accounts on some Linux systemsNewsCSO Online
- Technical University of Munich (TUM) IT security incident: myTUM passwords stolen, TUMonline taken offlineBreachpwn.watch
- French banking group hit by supply chain cyberattackNewsCSO Online
- Fake OpenAI, SpaceX events used to steal Microsoft, Google accountsNewsBleepingComputer
Source: https://www.rapid7.com/blog/post/ve-breaking-zimbra-identity-boundaries-part-1
ID