Zimbra Collaboration Server GraphQL Vulnerability Exposes Sensitive User Data
\n \t
\n
<\/BR>
\n
\n \t
\n
<\/BR><\/p>\n
A critical Cross-Site Request Forgery (CSRF)<\/a> vulnerability in Zimbra Collaboration Server (ZCS) versions 9.0 through 10.1, tracked as CVE-2025-32354, allows attackers to execute unauthorized GraphQL operations and access sensitive user data.\u00a0<\/p>\n The flaw resides in Zimbra\u2019s webmail interface\u2019s GraphQL endpoint (\/service\/extension\/graphql), where improper CSRF token validation enables malicious actors to manipulate authenticated users into triggering unintended actions.<\/p>\n CSRF attacks exploit a web application\u2019s trust in an authenticated user\u2019s browser. In this case, the absence of anti-CSRF tokens in Zimbra\u2019s GraphQL API permits attackers to craft malicious web pages or emails that force victims\u2019 browsers to submit forged requests.\u00a0<\/p>\n For instance, an attacker could embed a hidden form targeting Zimbra\u2019s GraphQL endpoint to:<\/p>\n The vulnerability is particularly severe because Zimbra\u2019s GraphQL API handles high-privilege operations without secondary authentication<\/a> checks.\u00a0<\/p>\n A proof-of-concept exploit demonstrated that a single malicious HTTP POST request could compromise an account if the victim visits a booby-trapped page while logged into Zimbra.<\/p>\n Zimbra\u2019s security team credited researcher 0xf4h1m for discovering the flaw through the Zero Day Initiative.<\/p>\nCritical CSRF Vulnerability in Zimbra\u2019s GraphQL Endpoint<\/strong><\/h2>\n
\n