High severity · published Oct 23, 2026
CVE-2026-50053
Zimbra Collaboration Suite RestFilter Request Attribute Override via Unauthenticated URL Parameters
New
8.7
CVSS
0.3%
EPSS
No
On KEV
Description
A request attribute override vulnerability in Zimbra Collaboration Suite (ZCS) allows unauthenticated requests to /h/* to populate servlet attributes intended for trusted internal dispatch. RestFilter copies URL parameters specifying an authentication token, target account, target item and dispatch state into the request attributes consumed by the Classic Web Client. Combined with CVE-2026-10632 on ZCS 10.1.16, this allows an attacker to supply their own valid token and document identifiers and execute JavaScript in another user's signed-in browser session. ZCS 10.1.17 blocks that XSS chain by changing the document renderer, but retains the request attribute override.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
High
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
Collaboration · Zimbra
through 10.1.17 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-50053
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-50053
wiki.zimbra.com
https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
www.rapid7.com
https://www.rapid7.com/blog/post/ve-breaking-zimbra-identity-boundaries-part-1/
More from Collaboration
8.9
CVE-2026-73570
Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability
6.1
CVE-2025-66376
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability
6.1
CVE-2024-27443
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability
9.8
CVE-2023-29382
An issue in Zimbra Collaboration ZCS v.8.8.15 and v.9.0 allows an attacker to execute arbitrary code via the sfdc_preauth.jsp component
9.8
CVE-2023-29381
An issue in Zimbra Collaboration (ZCS) v.8.8.15 and v.9.0 allows a remote attacker to escalate privileges and obtain sensitive information via the password and 2FA parameters