Read the docs
TI-2026-79897 Aliases CVE-2026-115786GHSA-w5xc-29c5-3j2h

Quota error in Zimbra Collaboration Suite enables mailbox exhaustion

Priority LOW 29CWE-682Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Zimbra Collaboration Suite (ZCS) versions through 10.1.20 are affected, including 10.1.16 and 10.1.20. A quota-accounting error (CWE-682) lets an authenticated user consume another user's mailbox quota by repeatedly sharing and revoking a document, because revocation does not reverse the mailbox-wide charge. On accounts with a finite quota, this can block incoming mail without any action by the recipient.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

A mailbox quota-accounting vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to consume another user’s mailbox quota by repeatedly sharing and revoking a document. Creation of the recipient’s shared-file record charges the document size to mailbox-wide usage. Revocation deletes the record and reverses its folder counters without reversing the mailbox-wide charge. Repeated normal share notifications therefore accumulate quota usage after the visible records are gone. On accounts with a finite quota, this can prevent incoming mail and other size-increasing operations without recipient interaction. The issue affects ZCS 10.1.16 and 10.1.20.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00383 32nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ZimbraZimbra Collaboration Suiteup to 10.1.20—No fix listedCNA
  • Zimbra Collaboration Suite VendorZimbra Affected up to 10.1.20 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*up to 10.1.20VulnerableSynacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:* Versions up to 10.1.20 Vulnerable ·Synacor

Remediation

The sources list no fixed version for Zimbra Collaboration Suite.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

  1. 2026-10-23 Threatist record created from CVE-2026-115786
  2. 2026-10-23 Alias added: GHSA-w5xc-29c5-3j2h
  3. 2026-10-24 Priority changed: MEDIUM → LOW
  4. 2026-10-28 CISA SSVC decision points changed

References

Advisory 1

Other 1

  • TI-2026-51660 OS command injection in Zimbra Collaboration KEVCVSS 3.1HIGH 8.9
  • TI-2025-40820 Cross-site scripting in Zimbra Collaboration KEVCVSS 3.1HIGH 7.2
  • TI-2024-18266 An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. KEVCVSS 3.1MEDIUM 6.1
  • TI-2024-30553 An issue was discovered in Zimbra Collaboration (ZCS) 10.1.x before 10.1.1, 10.0.x before… CVSS 3.1HIGH 8.8
  • TI-2022-13998 Zimbra Collaboration Open Source 8.8.15 does not encrypt the initial-login randomly… CVSS 3.1CRITICAL 9.8
  • TI-2026-63080 Path traversal in Zimbra Collaboration Suite CVSS 3.1CRITICAL 9.8
See all 94 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences