The vulnerability allows an unauthenticated attacker to bypass Zimbra's authentication rate limiting by using GraphQL aliasing to submit multiple credential guesses within a single request. This can enable brute‑force password attempts without triggering the usual source‑IP failure counter, increasing the chance of credential compromise. The weakness is identified as an authentication‑bypass flaw (CWE‑307).

Zimbra Collaboration Suite versions 10.1.0 through 10.1.21 from the vendor Zimbra are affected. The issue specifically targets the GraphQL interface provided by this collaboration suite.

The CVSS score of 3.7 classifies this as a low‑severity issue, and it is not listed in the CISA KEV catalog, but attackers could still exploit the rate‑limit bypass by repeatedly querying the GraphQL endpoint over the network. The EPSS score of 0.29% indicates that the current estimated exploitation probability is very low, yet the vulnerability’s nature suggests it could be accessed by anyone with network connectivity to the Zimbra instance. Likely attack vector is over the network via the GraphQL endpoint. There is no patch listed in the CVE data, so mitigations revolve around disabling or hardening the GraphQL service and enforcing alternate rate limiting.