Zimbra Collaboration Suite permits an unauthenticated external sender to craft an iCalendar REQUEST event that is accepted and automatically inserted into recipients' calendars. The system does not verify that the sender is authorized to represent the claimed ORGANIZER, so the event can appear to originate from any user. The created event is not added to the claimed organizer’s own calendar, indicating that the exploitation is limited to forging invitations rather than adding events to the organizer’s record.

The flaw affects Zimbra Collaboration Suite version 10.1.16 and 10.1.21. No other versions are cited in the advisory. The vulnerability resides in the calendar processing component of ZCS.

The CVSS score of 5.3 indicates a moderate level of severity. EPSS data is unavailable and the vulnerability is not listed in CISA KEV, suggesting the risk is real but not yet exploited at scale. An attacker only needs the ability to send a specially crafted external email when automatic invitation insertion is enabled; no user interaction or authentication is required. The attack path is therefore straightforward for anyone who can send outgoing mail to the affected system.