CVE-2026-73571

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration (ZCS) versions prior to 10.1.17

Description An authorization bypass occurs due to improper validation in the delegated email sending functionality. An authenticated attacker can send specially crafted SOAP requests to the SaveDraftRequest SOAP handler to impersonate another user and send emails without the necessary delegation or send-as permissions.

Recommendations Update Zimbra Collaboration (ZCS) to version 10.1.17 or later.