The flaw lies in the Zimbra Webmail application, which accepts CSRF tokens from the request body rather than enforcing the expected header. This incorrect validation allows a malicious site to instruct an authenticated user to perform unwanted operations, potentially resulting in data changes or account manipulation performed under the victim’s identity.

The vulnerability affects Zimbra Collaboration Suite versions 10.0 and 10.1. Administrators overseeing these deployments should confirm whether they run those versions. The issue was addressed in the 10.1.16 release notes.

The vulnerability carries a CVSS score of 5.4, denoting moderate risk, and an EPSS score of less than 1%, indicating a low likelihood of exploitation. It is not listed in the CISA KEV catalog. Exploitation requires a tricked, authenticated user to submit a crafted request, so the threat depends on user interaction and the presence of the vulnerable application.