CVE-2026-107573 Details
Description
Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a local authenticated user to read the mail server's data. The installer created the data, log, temp, database and event folders and the hMailServer.INI configuration file with the permissions inherited from the installation folder, by default under Program Files, which give the local Users group read access. Any user who can sign in to the computer could read every stored message, the logs, the built-in database with the accounts' password hashes whenever the service is stopped, and the configuration file, including the database password, which is sealed only with the machine's DPAPI key and can be unsealed by any local account; with an external database that password gives full control of it. The Linux AppImage of 6.3.0 through 6.3.5 likewise created its per-user data folders readable by other local users.
A vulnerability exists in the Windows installer of Progressive Robot hMailServer versions 6.0.0 through 6.3.5, where incorrect default permissions allow local authenticated users to read the mail server's data. The installer creates several folders and the hMailServer.INI configuration file with permissions inherited from the installation folder, typically under Program Files, which grants the local Users group read access. As a result, any user who can log into the computer could access stored messages, logs, the built-in database containing password hashes when the service is stopped, and the configuration file, including the database password. This password can be unsealed by any local account and, if an external database is used, provides full control over it. Additionally, the Linux AppImage version 6.3.0 through 6.3.5 also created per-user data folders that were readable by other local users.
Users should upgrade to hMailServer version 6.3.6, which addresses the permission issue by applying a protected DACL to the created folders and the hMailServer.INI file. Instructions for upgrading are available in the release notes for version 6.3.6.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 8, 2026CISA-ADP
Assessed Oct 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.6 | [email protected] | Release NotesVendor |
| https://gitlab.com/hmailserver/hmailserver/-/work_items/77 | [email protected] | ExploitIssue TrackingRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-276 | Incorrect Default Permissions | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Progressive Robot hMailServer | >= 6.0.0, <= 6.3.5 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 8, 2026 | CVE Modified | CISA-ADP |
| Oct 8, 2026 | New CVE Received | [email protected] |