An unauthenticated attacker can fraudulently craft an iCalendar REPLY component that is delivered with a null sender identity. Zimbra treats the REPLY as coming from the attendee, bypassing the usual attendee authorization filter. The forgery allows the attacker, knowing only the meeting UID, organizer address, and attendee address, to change the attendee’s participation status in the organizer’s calendar. The change occurs automatically during message delivery, so neither the attendee nor the organizer is notified or required to interact.

Zimbra Collaboration Suite (ZCS) version 10.1.16 and 10.1.21 are vulnerable. All deployments of these versions that process iCalendar REPLY components are at risk unless upgraded.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. The attack vector is inferred to be a remote, network-based delivery of a forged iCalendar REPLY via email. An attacker must know the meeting UID, organizer address, and attendee address, but no user interaction is required. Once the forged REPLY is processed, the attendee status is altered silently, potentially leading to miscommunication or scheduling conflicts.