Zimbra Collaboration Cross-Site Request Forgery Vulnerability in GraphQL Endpoint

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the GraphQL endpoint of Zimbra Collaboration (ZCS) versions 9.0 through 10.1. This vulnerability arises from inadequate CSRF token validation, allowing attackers to execute unauthorized GraphQL operations. Potential exploits include modifying contacts, altering account settings, and accessing sensitive user information, all triggered when an authenticated user visits a malicious website.

Impact

Exploitation of this vulnerability could lead to unauthorized modifications of contacts and account settings, as well as unauthorized access to sensitive user data.