Zimbra Collaboration Suite accepts iCalendar CANCEL and REQUEST components without verifying that the email sender is authorized to act as the supplied organizer. This authentication bypass lets an unauthenticated attacker cancel or modify an existing meeting in a recipient's calendar. The attacker provides a non‑outdated sequence number, which can move the meeting to Trash or replace its details, all upon email delivery without recipient interaction. The weakness corresponds to CWE‑290, Insecure Direct Object Reference.

The vulnerability is present in Zimbra Collaboration Suite version 10.1.16 and 10.1.21. An attacker needs to know the meeting UID and the original organizer email address to craft the malicious iCalendar component.

The CVSS score of 5.3 represents moderate severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, indicating that while exploitation is possible, no widespread active attacks have been reported. The likely attack vector is remote email delivery: an attacker sends a forged iCalendar message to a target user, and the system processes it automatically because no authorization check is performed. Successful exploitation requires knowledge of a valid meeting UID and organizer address, which limits the attack to situations where such details are obtainable or guessable. Consequently, the tangible risk is moderate but non‑negligible for environments that rely heavily on calendar events for coordination.