Vulnerability Report

CVE-2026-33372

Title: Zimbra Collaboration CSRF Vulnerability

Arbitrary File Access

Proof Of Concept

No public PoC currently indexed for CVE-2026-33372.

CWE Category NVD-CWE-noinfo

Published Date Mar 20, 2026

Modified Date Apr 01, 2026

Exploit Status Not Found

Score 5.4 CVSS v

Exploit Probability (EPSS)

0.03%

Vulnerability Summary

CVE-2026-33372: An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A cross-site request forgery (CSRF) vulnerability exists in Zimbra Webmail due to improper validation of CSRF tokens. The application accepts CSRF tokens supplied within the request body instead of requiring them through the expected request header. An attacker can exploit this issue by tricking an authenticated user into submitting a crafted request. This may allow unauthorized actions to be performed on behalf of the victim.

Impacted Vendors

synacor 1

zimbra 1

Reference Links

https://wiki.zimbra.com/wiki/Security_Center https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.16#Security_Fixes https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories

CVSS v3.1

Source Entity 134c704f-9b21-4f2e-91b3-4a467353bcc0

Severity MEDIUM

5.4

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

REQUIRED

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Associated Attack Patterns (CAPEC)

Total: Patterns