An email sanitization flaw in Zimbra Collaboration Suite allows an unauthenticated sender to craft an email containing a form whose action targets the Zimbra host. The sanitizers validate the form‑action hostname against the request hostname before the browser performs canonicalization. Because a percent‑encoded hostname can survive that check, the browser will submit the form to the legitimate Zimbra origin while carrying the recipient’s authentication cookie, permitting the attacker to trigger state‑changing requests from a crafted email. The flaw does not bypass CSRF‑token checks, so an endpoint that accepts the request without the token is still required for a successful attack.

The vulnerability is found in Zimbra Collaboration Suite versions 10.1.16 and 10.1.21. The affected vendor is Zimbra (Zimbra Collaboration Suite).

The CVSS score is 4.3, indicating low to moderate severity, and the EPSS score is not available while the CVE is not listed in CISA’s KEV catalog. The likely attack vector is email: an attacker sends a crafted message to a user, the user opens it in Classic, and upon submitting the embedded form the request is sent with the user’s cookies. Exploitation requires the target endpoint to accept a state‑changing request without the token. The vulnerability does not bypass CSRF‑token checks; an endpoint that accepts the resulting request without that protection is required for a successful attack.