Zimbra Collaboration implements authentication tokens that are issued during certain account state changes, such as enabling two‑factor authentication or changing a password. During these operations the tokens are created without CSRF protection, which allows a crafted request that an authenticated user sends through a browser to be executed without further validation. An attacker who successfully tricked a user into following a malicious link can therefore trigger SOAP requests that modify account settings, for example disabling two‑factor authentication or changing passwords, potentially compromising the victim’s account.

The vulnerability impacts Zimbra Collaboration Server (ZCS) deployments running the 10.0 and 10.1 release lines. Both versions of the web client issue authentication tokens that lack CSRF enforcement during specific state transitions, making the described attack feasible for users of these releases.

Official CVSS metrics are not provided and EPSS data is unavailable, but the requirement for an authenticated victim’s browser plus the ability to alter critical account security settings indicates moderate to high exploit risk. The vulnerability is not yet listed in the KEV catalog, yet organizations using the affected Zimbra releases should treat it as a serious risk due to the potential to defeat two‑factor authentication and undermine account integrity. The likely attack vector is a web‑based CSRF attack where an attacker sends a user an engineered link or embedded request, exploiting the missing CSRF checks.