CVE-2026-10631: Zimbra Collaboration Auth Bypass Flaw

CVE-2026-10631 Overview

CVE-2026-10631 is an authorization bypass vulnerability in the Exchange Web Services (EWS) FindItem handler of Zimbra Collaboration Suite 10. The flaw affects versions 10.1.0 through 10.1.19 when EWS is enabled. An authenticated user can read complete mailbox items, including raw MIME content and attachments, from arbitrary local accounts. The attack requires no share, delegation grant, or administrator permission. The vulnerability is tracked under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
Any authenticated Zimbra user with EWS access can read full mailbox contents of other local users on the same server without authorization.

Affected Products

Zimbra Collaboration Suite 10.1.0 through 10.1.19
Deployments with the EWS protocol handler enabled
Both single-server and multi-server Zimbra topologies hosting local accounts

Discovery Timeline

2026-10-08 - CVE CVE-2026-10631 published to NVD
2026-10-08 - Last updated in NVD database

Technical Details for CVE-2026-10631

Vulnerability Analysis

The vulnerability resides in the FindItem request handler of the EWS endpoint exposed by Zimbra Collaboration Suite. EWS is a SOAP-based protocol Zimbra implements for Outlook and third-party client interoperability. The FindItem operation normally returns item summaries from folders the authenticated user owns or has been granted access to.

In affected versions, the handler fails to verify that the requesting principal holds a valid share or delegation grant on the target mailbox. An attacker supplies a target account identifier in the EWS request body and receives item data, including raw MIME source and file attachments, from that mailbox. The result is unauthorized disclosure of email content, calendar entries, and attached files across tenants and users on the same Zimbra instance.

Exploitation requires only valid credentials for any local Zimbra account. No elevated role, administrator token, or prior delegation is needed, which lowers the barrier for insider abuse and credential-based attacks.

Root Cause

The root cause is missing cross-account authorization in the FindItem code path. The handler trusts the mailbox identifier supplied by the client without reconciling it against the authenticated session's permissions. This matches the [CWE-639] pattern where object references are controlled by the user and not validated server-side.

Attack Vector

The attack vector is network-based over the standard EWS SOAP endpoint, typically /ews/Exchange.asmx. An attacker authenticates with any valid Zimbra user credential, then issues a crafted FindItem SOAP request specifying the victim's mailbox and folder identifiers. The server returns item data without checking authorization. Full technical details are available in the Zimbra Security Advisories.

Detection Methods for CVE-2026-10631

Indicators of Compromise

EWS FindItem SOAP requests from one authenticated user targeting mailbox identifiers belonging to other accounts
Elevated volumes of /ews/Exchange.asmx POST traffic from a single session or source IP
Unexpected EWS access patterns from accounts that do not normally use Outlook or EWS clients
Audit log entries showing cross-account mailbox reads without corresponding share or delegation grants

Detection Strategies

Inspect Zimbra mailbox.log and access.log for EWS requests where the authenticated principal differs from the mailbox owner being queried
Baseline normal EWS usage per account and alert on deviations such as new user agents, bulk item retrieval, or access to unrelated mailboxes
Correlate authentication events with subsequent EWS traffic to identify compromised accounts enumerating other mailboxes

Monitoring Recommendations

Forward Zimbra proxy and mailbox logs to a centralized analytics platform for cross-user access correlation
Enable verbose EWS request logging during the remediation window to capture full SOAP bodies for forensic review
Monitor outbound data volumes from the Zimbra server to detect bulk MIME and attachment exfiltration

How to Mitigate CVE-2026-10631

Immediate Actions Required

Upgrade Zimbra Collaboration Suite 10.1.x to the fixed release identified in the Zimbra Security Advisories
Disable the EWS protocol handler on accounts and class-of-service profiles that do not require it
Rotate credentials for any account suspected of unauthorized access and review recent EWS activity
Audit mailbox access logs for cross-account FindItem activity preceding the patch deployment

Patch Information

Zimbra has published remediation guidance through the Zimbra Security Advisories wiki. Administrators should apply the vendor patch for Zimbra Collaboration Suite 10.1.x that addresses the FindItem authorization check. Follow the standard Zimbra patching workflow and restart the mailboxd service after installation.

Workarounds

Disable EWS globally by removing the zimbraFeatureEwsEnabled capability from classes of service that do not require Outlook interoperability
Restrict EWS endpoint access at the reverse proxy or firewall to known client source ranges
Enforce multi-factor authentication on all Zimbra accounts to reduce the risk of credential-based abuse

bash

# Disable EWS feature on a class of service as a temporary workaround
zmprov mc default zimbraFeatureEwsEnabled FALSE

# Restart mailboxd to apply the change
zmmailboxdctl restart