CVE-2026-73575
- State
- Published
- Severity
- 3.1 Low
- Published
- Aug 13, 2026
- Updated
- Aug 13, 2026
- Reserved
- Aug 12, 2026
Description
In Zimbra Collaboration (ZCS) before 10.1.17, a Cross-Site Request Forgery (CSRF) vulnerability exists in the Exchange Web Services (EWS) endpoint of Zimbra Collaboration (ZCS) due to insufficient validation of request content types. An attacker can exploit this vulnerability by causing an authenticated user to submit a crafted request, potentially allowing unauthorized actions to be performed on behalf of the victim.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 3.1 Low | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N | mitre |
Weaknesses
- CWE-352 Cross-Site Request Forgery (CSRF)
Affected Products
| Product | Versions |
|---|---|
CollaborationZimbra |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.