CVE-2026-50054

Executive Summary

CVE-2026-50054 is an authorization flaw in the Zimbra Collaboration Suite GrantRightsRequest component that permits any holder of an authenticated account to grant another local account the loginAs right. Successful abuse produces persistent delegated access to the victim mailbox, including the ability to send mail as that user, and the granted right survives both password changes and session expiry. Any organization running an unpatched Zimbra Collaboration Suite deployment with more than one provisioned account is potentially exposed; the flaw is network-reachable, requires only low privileges, and needs no user interaction (CVSS 7.1, CWE-269).

Technical Analysis

The vulnerability resides in Zimbra's rights-granting workflow, invoked through GrantRightsRequest. In Zimbra's delegation model, administrative and delegation rights are assigned between accounts, and certain rights — most notably impersonation-style rights such as loginAs — carry a far greater trust boundary than ordinary mailbox-sharing rights. The flaw is that the authorization check governing GrantRightsRequest does not adequately constrain who may grant which rights to whom. As a result, an attacker holding any authenticated local account can issue a rights-grant operation that assigns the loginAs right to a second local account under the attacker's control.

The critical property of this bug is persistence through the authentication lifecycle. Because the right is stored as an authorization grant on the target account rather than as an artifact of a session or a credential, it is not invalidated when the victim rotates their password or when existing sessions expire. This converts what might otherwise look like a transient privilege-escalation bug into a durable backdoor: the attacker retains the ability to authenticate as the victim mailbox long after any password remediation the victim performs.

Two distinct impacts follow from a loginAs grant:

• Confidentiality (CVSS C:H): the delegate can read the full contents of the victim mailbox, including historical mail, attachments, and any sensitive material retained in the account.
• Integrity (CVSS I:L): the delegate can send mail as the victim, enabling business email compromise, internal phishing from a trusted identity, and social engineering of the victim's contacts.

The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N is consistent with this analysis: remotely exploitable over the network, low attack complexity, low privileges required (any authenticated account), no user interaction, and scope unchanged.

No public proof-of-concept, Nuclei template, or exploit code exists for this CVE at the time of writing. The exact request body, parameter names beyond GrantRightsRequest and loginAs, and the precise authorization logic bypassed are not disclosed in the available NVD description; no further code-level detail should be assumed. The available data does not specify which Zimbra versions are affected — Affected Versions: [] — so version-specific scoping cannot be confirmed from source material.

Exploitation Scenarios

1) Reconnaissance / target identification. The attacker first acquires a valid authenticated account. This may be a low-privilege mailbox, a service account, or a compromised credential from an unrelated breach. Because the prerequisite is simply "access to an authenticated account" (PR:L), no administrative foothold is needed. The attacker identifies a target mailbox of interest — typically an executive, finance, IT, or help-desk account — and enumerates the local accounts they can reach. Zimbra's web client and SOAP endpoint are network-reachable (AV:N), so discovery and subsequent steps can be performed entirely over the network.

2) Triggering the flaw class. The attacker issues a GrantRightsRequest to grant a second local account (one they control) the loginAs right over the victim account. The authorization weakness is that this grant is not properly restricted — the vulnerable deployment does not enforce that the requester is entitled to delegate loginAs to that target. The attack is at the vulnerability-class level: a broken authorization check on a privilege-granting operation (CWE-269, improper privilege management). No user interaction is required (UI:N) and the complex conditions are low (AC:L).

3) Execution / grant establishment. The loginAs right is now persisted as an authorization grant on the attacker-controlled account. Unlike session theft or token replay, this grant is stored state, not a credential artifact.

4) Post-exploitation impact. Using the loginAs right, the attacker impersonates the victim: reading mailbox contents (C:H) and sending mail as the victim (I:L). The decisive consequence is durability — the grant survives the victim changing their password and survives session expiry, so standard credential-rotation incident response does not evict the attacker. Remediation instead requires explicitly revoking the improperly granted right. Realistic abuse cases include long-term mailbox surveillance, exfiltration of sensitive correspondence, and internal phishing or invoice-fraud emails sent from a trusted identity.

No public PoC is available; the above chain is inferred from the vulnerability class described in the NVD entry (GrantRightsRequest, loginAs, persistence semantics) and does not cite fabricated code, parameters, or endpoints.

Impact Assessment

The primary business impact is durable loss of mailbox confidentiality and the ability to send authenticated email as a trusted user. Because the grant survives password changes and session expiry, victims and responders may incorrectly believe the incident is remediated after a password reset, allowing continued access. CVSS 7.1 with C:H reflects the confidentiality weight of full mailbox access; I:L reflects limited but real integrity impact from mail-sending authority; A:N reflects no availability impact. Scope is unchanged (S:U). Blast radius is bounded by how many accounts the attacker can target and the sensitivity of those mailboxes. Organizations most at risk are those with:

• Shared or delegated mailboxes (executive assistants, help-desk, finance) where loginAs-style delegation is otherwise plausible and less likely to raise alarm.
• Weak credential hygiene or a large attack surface of low-privilege accounts, any one of which satisfies the PR:L precondition.
• No monitoring of rights-grant or delegation changes, which is required to catch the initial GrantRightsRequest.

No affected version list, EPSS score, CISA KEV listing, or in-the-wild exploitation evidence is available at this time.

Detection Guidance

Sigma Rule

title: Zimbra GrantRightsRequest loginAs Self-Grant Attempt
id: 8f2b1c44-7a90-4e12-b3c5-9d6e0a1f4c22
status: experimental
description: Detects Zimbra GrantRightsRequest operations that grant the loginAs right between local accounts, consistent with CVE-2026-50054 (CWE-269).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-50054
author: Threat Intelligence
date: 2026/01/01
logsource:
  product: zimbra
  service: mailbox
detection:
  selection_request:
    - 'GrantRightsRequest'
    - 'loginAs'
  filter_legitimate_admin:
    src_user|endswith:
      - 'admin@'
  condition: selection_request and not filter_legitimate_admin
falsepositives:
  - Legitimate administrative delegation via the admin console
  - Automated provisioning or mailbox-sharing workflows
level: high
tags:
  - attack.t1098
  - attack.persistence
  - cve.2026-50054

YARA Rule

rule CVE_2026_50054_Zimbra_GrantRights_loginAs
{
    meta:
        description = "Detects Zimbra SOAP requests or logs referencing GrantRightsRequest with the loginAs right, associated with CVE-2026-50054."
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-50054"
        date = "2026-01-01"
        severity = "high"

    strings:
        $soap_grant = "GrantRightsRequest" ascii nocase
        $right_login = "loginAs" ascii nocase
        $soap_ack = "<soap:" ascii nocase

    condition:
        $soap_grant and $right_login
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-50054 Zimbra GrantRightsRequest loginAs rights grant attempt"; flow:established,to_server; content:"GrantRightsRequest"; http_client_body; nocase; content:"loginAs"; http_client_body; nocase; classtype:attempted-user; reference:cve,2026-50054; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-50054; sid:202650054; rev:1;)

Elastic Detection

sequence by user.id with maxspan=30s
  [ any where process.name : "*" and wildcard(user.name, "*") and
    contains(network.protocol, "http") and
    contains(url.path, "*") and wildcard(url.path, "*") and
    contains(http.request.body, "GrantRightsRequest") ]

Splunk SPL Query

index=zimbra (sourcetype=zimbra_mailbox OR sourcetype=zimbra_audit)
| search "GrantRightsRequest" AND "loginAs"
| eval risk="high"
| stats count values(src_user) as actors values(target_user) as granted_accounts by host
| where count > 0

Wazuh OSSEC Rule

<group name="zimbra,cve-2026-50054,">
  <rule id="2026501" level="12">
    <decoded_as>json</decoded_as>
    <field name="message">GrantRightsRequest</field>
    <field name="message">loginAs</field>
    <description>CVE-2026-50054: Zimbra GrantRightsRequest with loginAs right detected - possible privilege grant/account manipulation (T1098)</description>
    <mitre>
      <id>T1098</id>
    </mitre>
    <group>privilege_escalation,persistence,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1) Immediate mitigations

• Audit and enforce least privilege on Zimbra delegation: restrict which accounts are permitted to exercise rights-granting operations, and treat the ability to invoke GrantRightsRequest as an administrative capability, not a standard one.
• Audit existing rights grants and revoke any unexpected loginAs grants. Because the right persists through password changes and session expiry, password resets alone do not remediate; explicit revocations are required.
• Rotate credentials of any accounts suspected of compromise and invalidate sessions, while undertanding this alone does not remove an existing loginAs grant.
• Apply network controls to Zimbra SOAP/web endpoints, allow-listing access to expected networks where feasible.
• Monitor/alert on all rights-grant operations involving loginAs (see Detection Guidance).

2) Patch / upgrade steps

• No patch, vendor fix, or workaround is currently available from any tracked source (Patch Sources: [], Vendor Fix: N/A, Workarounds: N/A). Monitor Zimbra's security advisory channel and the NVD entry for an official fix, and upgrade as soon as one is published. Because no affected version range is published, treat all deployments as potentially affected until scoping is clarified by the vendor.

3) Long-term hardening

• Adopt a formal delegation-governance policy: deny by default, document every grant, and periodically recertify delegated rights.
• Centralize and monitor administrative and delegation operations with alerting on anomalous grants.
• Segment Zimbra management interfaces from the general user network.
• Maintain an inventory of provisioned accounts and aggressively disable unused mailboxes to shrink the PR:L prerequisite surface.
• Track vendor advisories via an SBOM/vulnerability feed so unpatched authorization flaws receive proportionate priority given their persistence characteristics.

References

• NVD — CVE-2026-50054: https://nvd.nist.gov/vuln/detail/CVE-2026-50054
• CWE-269 — Improper Privilege Management: https://cwe.mitre.org/data/definitions/269.html
• MITRE ATT&CK T1098 — Account Manipulation: https://attack.mitre.org/techniques/T1098/
• Zimbra Security Center / advisories: https://wiki.zimbra.com/wiki/Security_Center
• CISA KEV Catalog (CVE-2026-50054 not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaign attribution or exploit-in-the-wild evidence is associated with CVE-2026-50054 at this time. No EPSS score has been published by FIRST.org.