ZeroDay Findings
Sign inSign up

Findings

CVE-2025-67809

An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1.

Published Dec 15, 2025 · updated Oct 14, 2026 · zimbra collaboration

An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A hardcoded Flickr API key and secret are present in the publicly accessible Flickr Zimlet used by Zimbra Collaboration. Because these credentials are embedded directly in the Zimlet, any unauthorized party could retrieve them and misuse the Flickr integration. An attacker with access to the exposed credentials could impersonate the legitimate application and initiate valid Flickr OAuth flows. If a user is tricked into approving such a request, the attacker could gain access to the user s Flickr data. The hardcoded credentials have since been removed from the Zimlet code, and the associated key has been revoked.

Timeline

Detection, updates, and resolution for this record.

  1. Dec 15, 2025 · NIST NVD

    Detected

    An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A hardcoded Flickr API key and secret are present in the publicly accessible Flickr Zimlet used by Zimbra Collaboration. Because these credentials are embedded directly in the Zimlet, any unauthorized party could retrieve them and misuse the Flickr integration. An attacker with access to the exposed credentials could impersonate

  2. Oct 14, 2026 · NIST NVD

    Updated

    An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A hardcoded Flickr API key and secret are present in the publicly accessible Flickr Zimlet used by Zimbra Collaboration. Because these credentials are embedded directly in the Zimlet, any unauthorized party could retrieve them and misuse the Flickr integration. An attacker with access to the exposed credentials could impersonate

Affected

  • cpe zimbra/collaborationversion unspecified

Sources

  • CVE.orgCVE-2025-67809

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2025-67809

    30-day exploitation probability 0.3%

    first.org
  • NIST NVDCVE-2025-67809

    An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A hardcoded Flickr API key and secret are present in the publicly accessible Flickr Zimlet used by Zimbra Collaboration. Because these credentials are embedded directly in the Zimlet, any unauthorized party coul

    nvd.nist.gov

References