CVE-2026-33373 Cross-site request forgery in n/a

High 8.8 Published 30 Mar 2026 Updated 1 Apr 2026

Attackers can bypass CSRF protections to perform sensitive account actions like disabling two-factor authentication in Zimbra Collaboration.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2026-33373?

CVE-2026-33373 is a high-severity vulnerability in Synacor Zimbra Collaboration Suite, published on 30 Mar 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A Cross-Site Request Forgery (CSRF) vulnerability exists in Zimbra Web Client due to the issuance of authentication tokens without CSRF protection during certain account state transitions. Specifically, tokens generated after operations such as enabling two-factor authentication or changing a password may lack CSRF enforcement. While such a token is active, authenticated SOAP requests that trigger token generation or state changes can be performed without CSRF validation. An attacker could exploit this by inducing a victim to submit crafted requests, potentially allowing sensitive account actions such as disabling two-factor authentication. The issue is mitigated by ensuring CSRF protection is consistently enforced for all issued authentication tokens.

Weakness: CWE-352

Which versions are affected by CVE-2026-33373?

It affects 1 product.

Products include Synacor Zimbra Collaboration Suite.

How do I fix CVE-2026-33373?

No fix has been published for CVE-2026-33373 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-33373 being exploited?

There is no known exploitation of CVE-2026-33373 in the wild and no public exploit code.

All Synacor Zimbra Collaboration Suite vulnerabilities

Sources

Also known as GHSA-pqjp-hqqg-x9w2.