A local privilege escalation flaw exists in the Zimbra Collaboration Suite’s Mail Transfer Agent. The vulnerability results from allowing the zimbra process account to execute Postfix administration commands via sudo without a password, enabling arbitrary commands to run as root. An attacker who can execute commands as the zimbra user can select a zimbra‑controlled daemon_directory in the Postfix configuration and invoke the set‑permissions command, which then runs an attacker‑supplied post‑install program as root. This leads to full compromise of the host where the MTA runs, and the weakness is an incorrect authorization flaw (CWE‑732).

Affected products are the Zimbra Collaboration Suite, specifically version 10.1.16 and 10.1.21. The issue impacts the Postfix MTA component on nodes that host the mail transfer agent.

The CVSS score of 7.8 marks this as high severity. Because the exploit can be performed by any local user that can execute commands as the zimbra account, the attack surface is limited only to systems where the attacker can gain such local access. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog; nonetheless, the lack of a password requirement for sudo means installation of a patch should be treated as a priority.