Description
CVE-2026-73571 is an authorization failure in Zimbra Collaboration's delegated SaveDraftRequest path. An ordinary authenticated user can select another mailbox on the same mailbox server in the From element and cause Zimbra to send the message under that account's owner context. The legitimate MTA path also saves the message in the selected account's Sent folder.
The vulnerability requires no delegation grant or privileged account. It is known to affect Zimbra 10.1.16, was absent in the original 10.1.0 release, and is fixed in 10.1.17. The exact introduced release is unknown.
When the recipient is the authenticated attacker, or recipient credentials are supplied, the module independently polls that Inbox and verifies the resulting From address. Without that verification, an accepted SOAP response remains unverified on every version.
Module options
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
msf > use auxiliary/admin/http/zimbra/email_impersonationmsf undefined(email_impersonation) > show actions ...actions...msf undefined(email_impersonation) > set ACTION < action-name >msf undefined(email_impersonation) > show options ...show and set options...msf undefined(email_impersonation) > runPrioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub