---
title: Rapid7 reports 80+ Zimbra flaws; part 1 covers impersonation, cross-mailbox EWS reads and a Sieve forwarding bypass | ctxsec
url: https://ctxsec.com/items/rapid7-zimbra-80-vulns-part1
description: ""
status: "confirmed (researcher + fixed releases); no known exploitation"
published: 2026-10-13
---

> 

[← Cybersecurity News](/news) · [markdown](/items/rapid7-zimbra-80-vulns-part1.md)

confirmed (researcher + fixed releases); no known exploitation

2026-10-13

### Rapid7 reports 80+ Zimbra flaws; part 1 covers impersonation, cross-mailbox EWS reads and a Sieve forwarding bypass

Rapid7 says a broad review of Zimbra Collaboration Suite turned up more than 80 vulnerabilities, and it is publishing them in four parts as fixes ship. Part 1 (Oct 13) covers five account-level bugs. CVE-2026-73571 (CVSS 8.3) lets any logged-in user send mail as another local user through SaveDraftRequest; fixed in ZCS 10.1.17. CVE-2026-10631 lets a user read other users' mailboxes over EWS, and CVE-2026-50055 bypasses forwarding restrictions with Sieve notify; both fixed in 10.1.20. CVE-2026-93637 lets attackers dodge the GraphQL login rate limit, and CVE-2026-93635 is an LDAP filter injection; neither has a public fix listed yet. Later parts will cover unauthenticated stored XSS and a path from SSRF to code execution as zimbra and then root. Run 10.1.20 or later, and watch for the rest of the series.

Sources: [Rapid7: Breaking Zimbra's Identity Boundaries (Part 1)](https://www.rapid7.com/blog/post/ve-breaking-zimbra-identity-boundaries-part-1/)