# From One Account to Every Mailbox: Breaking Zimbra's Identity Boundaries (Part 1)
Five Zimbra flaws: GraphQL rate-limit bypass, LDAP injection, email impersonation, EWS IDOR, and Sieve notify bypass enable account takeover and data exfiltration.
- Payout: Research
- Severity: high
- Program: Zimbra Collaboration Suite
- Found by (vendor credit): Jonah Burgess (CryptoCat), Senior Security Researcher, Rapid7
- Write-up by: Jonah Burgess
- Disclosed: 2026-10-14
- CVE: CVE-2026-93637, CVE-2026-93635, CVE-2026-73571, CVE-2026-10631, CVE-2026-50055
- Write-up quality: 9/10
- Original: https://www.rapid7.com/blog/post/ve-breaking-zimbra-identity-boundaries-part-1
- Library page: https://bugbountylibrary.com/r/blog%3Arapid7-com-blog-post-ve-breaking-zimbra-identity-boundaries-part-1
- Tags: area:web domain:web impact:ato impact:data-leak impact:pii-leak kind:research platform:threat-intel sev:high tech:graphql tech:rest vuln:access-control vuln:auth-bypass vuln:business-logic vuln:idor
**Target:** Zimbra Collaboration Suite (GraphQL, SOAP, EWS, Sieve)
**Root cause:** Multiple: GraphQL auth bypasses SOAP failure handler; LDAP filter injection in computeDn; SaveDraftRequest trusts From address; EWS FindItem uses attacker-supplied owner UUID for authorization context; Sieve notify action not blocked by forwarding restriction.
**Steps:**
1. GraphQL rate-limit bypass: send batched authenticate mutations with aliases to /service/extension/graphql, e.g. `mutation { a0: authenticate(...) a1: authenticate(...) ... }`; failures not counted by IP filter.
2. LDAP filter injection: on external LDAP domains, use wildcarded login like `jdoe*@example.test` in authenticate mutation; correct password yields different response.
3. Email impersonation: send SaveDraftRequest with `isDelegatedReq="1"` and From address of target local user; message sent as that user and copied to their Sent folder.
4. EWS IDOR: obtain target UUID via GetAccountInfoRequest; send FindItem with FolderId `{uuid}_2` (Inbox) to /service/extension/zimbraews; read victim's mailbox items.
5. Sieve notify bypass: install filter rule with `actionNotify` to external address and `actionKeep` via ModifyFilterRulesRequest; exfiltrates future message text and headers.
**How found:** Code review of Zimbra source: noticed GraphQL path bypasses SoapEngine failure handler; LDAP filter not escaped; SaveDraftRequest lacks authorization check; EWS uses composite ID owner UUID for context; Sieve check only blocks redirect action.
**Exploitation:** GraphQL bypass allows password guessing without IP lockout; LDAP injection enables password oracle for external directory users; SaveDraftRequest impersonates any local user, bypassing SPF/DKIM/DMARC; EWS IDOR reads any user's mailbox folders; Sieve notify exfiltrates email content persistently.
**Escalation:** Chaining: impersonation makes XSS delivery credible; EWS IDOR enables password reset interception; Sieve bypass persists after session expiry.
**Insight:** Look for alternate API paths (GraphQL vs SOAP) that bypass security filters; check if authorization context is derived from user-supplied identifiers (UUIDs) rather than authenticated session; verify that policy checks cover all equivalent actions (e.g., notify vs redirect).
## Proof of concept (copied exactly from the original report)
**Batched GraphQL authenticate aliases bypassing rate limit**
```
mutation {
a0: authenticate(authInput: {account: {accountBy: name, key: "[email protected]"}, password: "pass0"}) { authToken }
a1: authenticate(authInput: {account: {accountBy: name, key: "[email protected]"}, password: "pass1"}) { authToken }
a2: authenticate(authInput: {account: {accountBy: name, key: "[email protected]"}, password: "pass2"}) { authToken }
}
Each alias performs a real authentication operation. Failures appear in the GraphQL errors array
```
**SaveDraftRequest impersonating another local sender**
```
Updated payroll review
Please review the changes.
```
**EWS FindItem reading another user's Inbox**
```
AllProperties
true
```