CVE-2026-115786

The record

A mailbox quota-accounting vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to consume another user’s mailbox quota by repeatedly sharing and revoking a document. Creation of the recipient’s shared-file record charges the document size to mailbox-wide usage. Revocation deletes the record and reverses its folder counters without reversing the mailbox-wide charge. Repeated normal share notifications therefore accumulate quota usage after the visible records are gone. On accounts with a finite quota, this can prevent incoming mail and other size-increasing operations without recipient interaction. The issue affects ZCS 10.1.16 and 10.1.20.

Affected packages

Related vulnerabilities

• CVE-2026-106438 An incorrect calculation in Decimal128 string parsing in the MongoDB C Driver can accept… CWE-682
• CVE-2026-53670 PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. CWE-682
• CVE-2026-53671 PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. CWE-682
• CVE-2026-53706 PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. CWE-682
• CVE-2026-54754 Klever-Go is the Go implementation of the Klever blockchain protocol. CWE-682
• CVE-2026-76043 Incorrect calculation in V8 in Google Chrome prior to 151.0.7922.169 allowed a remote… CWE-682
• CVE-2026-71479 New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset… CWE-682
• CVE-2026-20763 Incorrect calculation for some Intel(R) TDX Guest software before version 0.3.1 within… CWE-682