CVE-2026-93631 Zimbra Collaboration Suite OAuth Extension Cross-Site Request Forgery Enables Account Linking

High 7.1 Published 23 Oct 2026 Updated 28 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-93631?

CVE-2026-93631 is a high-severity vulnerability in Synacor Zimbra Collaboration Suite, published on 23 Oct 2026.

Official description

A cross-site request forgery vulnerability in the OAuth extension of Zimbra Collaboration Suite (ZCS) Network Edition allows an attacker to link an attacker-controlled external account to a victim's mailbox. The OAuth callback does not bind its state value or authorization code to the initiating Zimbra session and instead selects the destination mailbox from the browser's current authentication cookie. On a deployment with the provider configured, an attacker can induce a signed-in victim to load a callback containing a fresh code for the attacker's provider account. This creates a persistent data source that imports attacker-controlled contacts or events. With bidirectional CalDAV synchronization, appointments subsequently created or edited in the linked calendar are also disclosed to the attacker. ZCS 10.1.16 and 10.1.20 are affected.

Weakness: CWE-352

Which versions are affected by CVE-2026-93631?

It affects 1 product.

Products include Synacor Zimbra Collaboration Suite.

How do I fix CVE-2026-93631?

No fix has been published for CVE-2026-93631 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-93631 being exploited?

There is no known exploitation of CVE-2026-93631 in the wild and no public exploit code.

All Synacor Zimbra Collaboration Suite vulnerabilities

Sources

Also known as GHSA-8c8x-hffr-47hm.