High
Zimbra Collaboration Suite GrantRightsRequest SOAP Handler Allows Self-Granting of Undocumented loginAs Mailbox Delegation Right
An authorization flaw in Zimbra Collaboration Suite’s GrantRightsRequest allows an attacker with access to an authenticated account to grant another local account the loginAs right, creating persistent mailbox access and mail-sending authority that survives password changes and session expiry.
Announced Source revision 1
Original source ↗CVE-2026-50054
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-50054
Zimbra Collaboration Suite
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "Zimbra",
"product": "Zimbra Collaboration Suite",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "10.1.20",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-50054
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #15682 · Revision 1
- Added to Heist Feed
- Publisher date