The vulnerability is an LDAP filter injection that allows an authenticated user to request otherwise hidden attributes of calendar resources. By including malicious attribute names, the attacker can inject additional LDAP conditions and iteratively retrieve readable attributes such as internal hostnames and mail routes. This results in sensitive internal information disclosure but does not grant direct access to the underlying mailboxes or system binaries.

The flaw affects Zimbra Collaboration Suite versions 10.1.16 and 10.1.21. Only Zimbra's LDAP service is impacted; other components remain unaffected. Users exposed to the SearchCalendarResourcesRequest endpoint can exploit the flaw if they have valid credentials.

The CVSS score of 4.3 indicates moderate severity. The exploit probability is currently unknown because EPSS is not available, and the vulnerability is not tracked as a known exploited event. Attackers require authenticated access, but the scope is limited to calendar-resource objects and the rights of the LDAP service account. If an attacker succeeds, they gain only non‑privileged internal information, reducing potential for broader compromise. Nonetheless, organizations should treat the flaw as a risk to internal confidentiality.