NewsRapid7
From One Account to Every Mailbox: Breaking Zimbra's Identity Boundaries (Part 1)
Linked advisories
- CVE-2026-93635Zimbra Collaboration Suite: LDAP-Injection
- CVE-2026-50055Zimbra Collaboration Suite: fehlerhafte Autorisierung
- CVE-2026-10631Synacor Zimbra: Mehrere Schwachstellen
- CVE-2026-50055Zimbra Collaboration Suite: fehlerhafte Autorisierung
- CVE-2026-50054Synacor Zimbra: unzureichende Rechteverwaltung
- CVE-2026-50054Synacor Zimbra: unzureichende Rechteverwaltung
- CVE-2026-93635Zimbra Collaboration Suite: LDAP-Injection
- CVE-2026-93637Zimbra Collaboration Suite: fehlende Begrenzung von Anmeldeversuchen
- CVE-2026-10631Zimbra Collaboration Suite: Umgehung der Autorisierung über nutzergesteuerten Schlüssel
- CVE-2026-10631Zimbra Collaboration Suite: Umgehung der Autorisierung über nutzergesteuerten Schlüssel
- CVE-2026-93637Zimbra Collaboration Suite: fehlende Begrenzung von Anmeldeversuchen
- CVE-2026-73571Synacor Zimbra: Mehrere Schwachstellen
- CVE-2026-73571Zimbra Collaboration: fehlerhafte Autorisierung
- CVE-2026-93635Synacor Zimbra: Mehrere Schwachstellen
- CVE-2026-73571Zimbra Collaboration: fehlerhafte Autorisierung
Affected vendors and products
More on Account
Other advisories
- HighCVE-2026-118045Ever Accounting: externe Kontrolle von Dateinamen oder -pfaden
- HighCVE-2026-118045Ever Accounting: externe Kontrolle von Dateinamen oder -pfaden
- Mediumpwn_watch:claude-code-account-email-user-agent-leak-nov-2026Claude Code sends your account email to websites: agent puts the signed-in address into User-Agent headers
- HighCVE-2026-123158Alpine Linux sshd password authentication bypass lets anyone log in to key-only accounts (CVE-2026-123158)
- CriticalCVE-2026-117691Keycloak SAML redirect-binding signature bypass lets attackers take over federated accounts (CVE-2026-117691)
- MediumCVE-2026-99226keys: Avoid the owner account dereference in named keyring lookup
- Not ratedosv:CVE-2026-121735blueprintUE Self-Hosted Edition before 4.3.4 Non-Expiring Account Confirmation Tokens
- Not ratedosv:CVE-2026-121628Bagisto before 2.3.16 and 2.4.x before 2.4.1 Race Condition in Coupon Usage Accounting
Other news entries
- Tensorlake: attacker reached engineering GitHub via vendor-hosted sandboxes after unrotated env varsBreachpwn.watch
- Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on HoneypotNewsThe Hacker News
- DigiCert Data Breach Impacts Business Customer InformationNewsSecurityWeek
- OpenSSH Rushes Patches for ‘SSHole’ Authentication BypassNewsSecurityWeek
- 3 Charged in Scheme to Use AI to Impersonate CEOs and Attorneys to Steal $129 MillionNewsSecurityWeek
- OpenSSH flaw lets attackers access password-disabled accounts on some Linux systemsNewsCSO Online
- Web3Auth infrastructure breach exposed private keys for some Keplr Google/Apple-login walletsBreachpwn.watch
- Technical University of Munich (TUM) IT security incident: myTUM passwords stolen, TUMonline taken offlineBreachpwn.watch
Source: https://www.rapid7.com/blog/post/ve-breaking-zimbra-identity-boundaries-part-1
ID