# CVE-2025-67809: An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A hardcoded Flickr API key and secret are present…

Source: https://junglewise.ai/threats/cve-2025-67809-an-issue-was-discovered-in-zimbra-collaboration-zcs-10-0-and-10-1  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-15  
License: CC BY 4.0 with a link back

CVE-2025-67809 · Severity: medium · CVSS 4.7 · Published 2025-12-15

An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A hardcoded Flickr API key and secret are present in the publicly accessible Flickr Zimlet used by Zimbra Collaboration. Because these credentials are embedded directly in the Zimlet, any unauthorized party could retrieve them and misuse the Flickr integration. An attacker with access to the exposed credentials could impersonate the legitimate application and initiate valid Flickr OAuth flows. If a user is tricked into approving such a request, the attacker could gain access to the user s Flickr data. The hardcoded credentials have since been removed from the Zimlet code, and the associated key has been revoked.

Technologies: [Zimbra Collaboration](https://junglewise.ai/threats/technologies/collaboration). Vendors: [Zimbra](https://junglewise.ai/threats/vendors/zimbra).

## Quick answers

**Is CVE-2025-67809 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-67809 being exploited in the wild.

**How severe is CVE-2025-67809?** Medium severity, with a CVSS score of 4.7, published 15 December 2025.

**Which products and versions are affected?** Zimbra Collaboration. The advisory does not name versions.

**Is there a fix for CVE-2025-67809?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2025-67809?** Check whether you run Zimbra Collaboration. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Zimbra Collaboration

## Related threats

- [Zimbra Collaboration stored XSS in share notifications](https://junglewise.ai/threats/cve-2026-93642-an-unauthenticated-sender-can-forge-a-share-notification-that)
- [Zimbra Collaboration stored XSS in share notifications](https://junglewise.ai/threats/cve-2026-93641-an-unauthenticated-sender-can-forge-a-share-notification-that)
- [Zimbra Collaboration deserialization attack via unspecified vectors](https://junglewise.ai/threats/cve-2016-3415-zimbra-collaboration-deserialization-attack-via-unspecified)
- [Zimbra Collaboration integrity vulnerability via unknown vectors](https://junglewise.ai/threats/cve-2016-3413-zimbra-collaboration-integrity-vulnerability-via-unknown-vectors)
- [Zimbra Collaboration Multiple XSS Vulnerabilities](https://junglewise.ai/threats/cve-2016-3412-zimbra-collaboration-multiple-xss-vulnerabilities)