{"id":"CVE-2020-10194","url":"https://www.cyber-defence.io/tools/cve/CVE-2020-10194","generatedAt":"2026-10-27T23:24:55.187Z","title":"cs/service/account/AutoCompleteGal.java in Zimbra zm-mailbox before 8.8.15.p8 allows authenticated users to request any GAL account.","description":"cs/service/account/AutoCompleteGal.java in Zimbra zm-mailbox before 8.8.15.p8 allows authenticated users to request any GAL account. This differs from the intended behavior in which the domain of the authenticated user must match the domain of the galsync account in the request.","published":"2020-03-20T21:15:17.000Z","lastModified":"2026-06-17T02:47:29.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"3.1","score":6.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"},"cwe":["CWE-862"],"affected":["zimbra/zm-mailbox"],"epss":{"score":0.0121,"percentile":0.68232,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (1.21%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://github.com/Zimbra/zm-mailbox/commit/1df440e0efa624d1772a05fb6d397d9beb4bda1e","tags":["Patch","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://github.com/Zimbra/zm-mailbox/compare/8.8.15.p7...8.8.15.p8","tags":["Patch","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://github.com/Zimbra/zm-mailbox/pull/1020","tags":["Patch","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://github.com/Zimbra/zm-mailbox/commit/1df440e0efa624d1772a05fb6d397d9beb4bda1e","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/Zimbra/zm-mailbox/compare/8.8.15.p7...8.8.15.p8","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/Zimbra/zm-mailbox/pull/1020","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2020-10194","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}