CVE-2026-50053: Request Attribute Override in Zimbra

CVE-2026-50053 describes a request attribute override vulnerability in Zimbra Collaboration Suite (ZCS). The flaw allows unauthenticated requests to /h/* endpoints to populate servlet attributes that should only be used for trusted internal dispatch. The RestFilter in ZCS copies URL parameters specifying an authentication token, target account, target document, and dispatch state directly into request attributes consumed by Classic Web Client.

The CVSS score is 8.7 (high). The vulnerability gains impact when combined with CVE-2026-10632 on ZCS 10.1.16: it allows an attacker to supply a valid token and document identifiers, executing JavaScript in another user's authenticated session. ZCS 10.1.17 mitigates the XSS chain by modifying the document renderer, but retains the request attribute override. As of 2026-10-29, public detectors are available on GitHub repositories that report version exposure.

ZCS administrators must verify their installed version. For ZCS 10.1.16, upgrading to ZCS 10.1.17 is the indicated fix. Since version 10.1.17 does not fully resolve the issue, regularly check Zimbra advisories for subsequent patches and evaluate applying additional mitigations recommended by the vendor.