A missing authorization flaw allows a delegated administrator to modify global Zimlet settings via the ConfigureZimletRequest endpoint. With this capability, the attacker can add a malicious domain to a proxy allowlist for the default class of service. When a normal user from that class opens a specially crafted /service/proxy URL, the server serves attacker‑controlled HTML under its own origin. Because the content is served from the same origin, the embedded JavaScript can read mailbox data and perform any actions that the victim is authorized to do, effectively hijacking the victim’s session. This represents a privilege escalation from a delegated administrator to full control over the victim’s mailbox.

The vulnerability affects Zimbra Collaboration Suite, specifically versions 10.1.16 and 10.1.20. Delegated administrators possessing an account with access to the admin SOAP service are required to exploit the flaw. No other system components or third‑party products are explicitly impacted.

The CVSS score of 8.7 indicates high severity. The EPSS score is not available, so the probability of exploitation cannot be quantified at this time. The vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation. Exploitation requires a delegated administrator account and the ability to invoke the admin SOAP service, after which an attacker can deliver the crafted proxy URL to a victim’s browser. Given the reliance on both privileged credentials and victim interaction, the attack requires a two‑step process but if achieved, it provides the attacker with near‑full administrative capabilities within the victim’s mailbox.