diff --git a/zarafa-7.1.14-pam_acct_mgmt.patch b/zarafa-7.1.14-pam_acct_mgmt.patch
new file mode 100644
index 0000000..4631a0f
--- /dev/null
+++ b/zarafa-7.1.14-pam_acct_mgmt.patch
@@ -0,0 +1,41 @@
+Patch by Robert Scheck <robert@fedoraproject.org> for Zarafa <= 7.1.14 which backports the security fix
+by Andreas Rönnquist <gusnan@librem.one> for Kopano Core <= 11.0.2.51 (for Debian). It fixes a security
+issue which allows attackers to authenticate even if the user account or password is expired. See also:
+
+ - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26562
+ - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1016973
+ - https://jira.kopano.io/browse/KC-2021
+ - https://github.com/Kopano-dev/kopano-core/blob/master/provider/libserver/ECKrbAuth.cpp#L137
+ - https://bugzilla.redhat.com/show_bug.cgi?id=2192126
+
+The security flaw was introduced between Zarafa 6.30.0 RC 1e (Subversion Revision 14802) and 6.30.8 Final
+(Subversion Revision 18345) in provider/libserver/ECPamAuth.cpp and also affects Kopano Core <= 11.0.2.51
+in provider/libserver/ECKrbAuth.cpp.
+
+--- zarafa-7.1.14/provider/libserver/ECPamAuth.cpp			2015-10-20 11:13:45.000000000 +0200
++++ zarafa-7.1.14/provider/libserver/ECPamAuth.cpp.pam_acct_mgmt	2023-02-09 19:53:11.843375272 +0200
+@@ -111,14 +111,21 @@
+ 	}
+ 
+ 	res = pam_authenticate(pamh, PAM_SILENT);
+-
+-	pam_end(pamh, res);
+-
+ 	if (res != PAM_SUCCESS) {
+ 		*lpstrError = pam_strerror(NULL, res);
++		pam_end(pamh, res);
+ 		er = ZARAFA_E_LOGON_FAILED;
+ 	}
+ 
++	res = pam_acct_mgmt(pamh, PAM_SILENT);
++	if (res != PAM_SUCCESS) {
++		*lpstrError = pam_strerror(NULL, res);
++		pam_end(pamh, res);
++		er = ZARAFA_E_LOGON_FAILED;
++	}
++
++	pam_end(pamh, res);
++
+ exit:
+ 	pthread_mutex_unlock(&cPAMLock.m_mPAMAuthLock);
+ 
diff --git a/zarafa.spec b/zarafa.spec
index 6d5236d..5ed9d99 100644
--- a/zarafa.spec
+++ b/zarafa.spec
@@ -1,5 +1,5 @@
 %global beta_or_rc      0
-%global actual_release  5
+%global actual_release  6
 %global svnrevision     51822
 %global with_search     1
 %global with_ldap       1
@@ -76,6 +76,7 @@ Patch19:            https://raw.githubusercontent.com/robert-scheck/zarafa-patch
 Patch20:            https://raw.githubusercontent.com/robert-scheck/zarafa-patches/main/zarafa-7.1.14-libical3.patch
 Patch21:            https://raw.githubusercontent.com/robert-scheck/zarafa-patches/main/zarafa-7.1.14-ical-remote-dos.patch
 Patch22:            https://raw.githubusercontent.com/robert-scheck/zarafa-patches/main/zarafa-7.1.14-ical-remote-dos2.patch
+Patch23:            https://raw.githubusercontent.com/robert-scheck/zarafa-patches/main/zarafa-7.1.14-pam_acct_mgmt.patch
 
 BuildRequires:      bison
 BuildRequires:      gcc-c++
@@ -428,6 +429,7 @@ rm -f php-webclient-ajax/{.,*,*/*,*/*/*/*}/*.webaccess-*
 %patch20 -p1 -b .libical3
 %patch21 -p1 -b .ical-remote-dos
 %patch22 -p1 -b .ical-remote-dos2
+%patch23 -p1 -b .pam_acct_mgmt
 
 %build
 %if 0%{?rhel}%{?fedora} < 6
@@ -971,6 +973,9 @@ fi
 %{python_sitearch}/*
 
 %changelog
+* Sun Apr 30 2023 Robert Scheck <robert@fedoraproject.org> 7.1.14-6
+- Backported patch from Debian to fix CVE-2022-26562 (#2192126)
+
 * Sun Apr 25 2021 Robert Scheck <robert@fedoraproject.org> 7.1.14-5
 - Added upstream patch to fix remote DoS in zarafa-ical (#1953242)