A Cross‑Site Request Forgery vulnerability exists in the Zimbra Collaboration Suite Web Client. Auth tokens are issued without CSRF protection following certain account state changes, such as enabling two‑factor authentication or changing a password. Because these tokens are active, an attacker can perform SOAP requests that trigger state changes without CSRF validation. The weakness is a classic CSRF flaw (CWE‑352) that can allow an attacker to disable two‑factor authentication and potentially conduct other privileged account actions.

The flaw affects Zimbra Collaboration Suite versions 10.0 and 10.1. The affected products are listed under the vendor Synacor as Zimbra Collaboration Suite. Specific releases that contain the fix include 10.0.18 and 10.1.13.

The CVSS score of 8.8 indicates high severity, but the EPSS score of less than 1% suggests that exploitation is currently unlikely. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a victim forging a crafted request by being tricked into visiting a malicious page; the attacker could then use the compromised session to perform privileged actions. The risk is significant for any organization that relies on Zimbra’s Web Client for account management.