A cross-site request forgery flaw in the OAuth extension of Zimbra Collaboration Suite allows an attacker to force a logged-in victim to associate an attacker-controlled external account with the victim’s mailbox. The flaw stems from the OAuth callback not tying the state or authorization code to the originating Zimbra session, and instead selecting the mailbox based on the victim’s authentication cookie. Once linked, the external account can import arbitrary contacts or events into the victim’s calendar and, with CalDAV bidirectional sync, any future appointments created or edited in the linked calendar are exposed back to the attacker. This results in persistent data exfiltration and potential manipulation of the victim’s calendar.

Zimbra Collaboration Suite Network Edition versions 10.1.16 and 10.1.20 are. The flaw affects installations where the OAuth provider is configured to allow external account linking.

The CVSS score of 7.1 indicates a moderate severity level and the exploit requires a victim who is already authenticated to the target Zimbra instance. The vulnerability is not listed in the CISA KEV catalog and no EPSS score is available, suggesting either limited evidence of exploitation or a recent disclosure. Nonetheless, the attack path is straightforward: an attacker can trick a logged-in user with a malicious link that triggers the OAuth callback. The resulting account link persists, granting the attacker continuous access to the victim’s contacts and calendar data. Given the potential for ongoing data compromise, rapid remediation is advisable.