The flaw resides in Zimbra Collaboration Suite’s quota accounting logic, where the creation of a shared‑file record charges the recipient’s mailbox quota, while the subsequent revocation removes the record but does not reverse the quota charge. Repeating share and revoke operations can therefore accumulate hidden quota usage, ultimately exhausting a user’s mailbox space without the recipient’s interaction. As a result, affected accounts may be prevented from receiving mail or performing other size‑increasing tasks, effectively causing a denial of service based on quota exhaustion.

This issue affects Zimbra Collaboration Suite versions 10.1.16 and 10.1.20, bundled under the Zimbra brand.

The vulnerability carries a CVSS score of 6.5, and its EPSS score is currently unavailable; it is not listed in the CISA KEV catalog. An attacker must first authenticate to the Zimbra instance to exploit the flaw, indicating that the primary attack vector is authenticated remote. Once authenticated, the attacker can repeatedly share and revoke documents to drain another user’s mailbox quota, thereby disrupting email delivery for that user.