The vulnerability is a cross‑account authorization bypass that allows an authenticated Zimbra user to insert forged shared‑file records into another user's mailbox via the FileSharedWithMeRequest endpoint. The request accepts attacker‑selected metadata, owner identifiers, and declared sizes without verifying that a legitimate document share exists, enabling the planting of entries attributed to other local accounts. Because no victim interaction is required, an attacker can manipulate the recipient’s shared‑file list and potentially mislead the account owner about the existence of shared documents. This can compromise the integrity and authenticity of mailbox data, and may facilitate social engineering or account impersonation.

This issue affects Zimbra Collaboration Suite 10.1.16 and 10.1.20. Other Zimbra versions not listed may or may not be impacted; check with the vendor for confirmation.

The CVSS base score of 4.3 rates the vulnerability as moderate. EPSS is not available, and the vulnerability is not in the CISA KEV catalog, suggesting no widely reported exploitation at this time. Attackers must be authenticated within the organization and rely on existing user accounts, so the attack vector is internal. While no public exploits are documented, the ability to inject arbitrary shared‑file entries could aid broader compromise or cause confusion among users. Patch promptly and monitor for unusual shared‑file activity to reduce risk.