CVE-2026-107586 Details
Description
Uncontrolled eviction in the browser session table of the REST API in Progressive Robot hMailServer 6.2.28 through 6.3.5 allows a remote authenticated user to end other users' sessions. The table of browser sessions, shared by every account, the server administrator and support sessions, dropped its least recently used session whenever it was full, whoever it belonged to, and placed no limit on how many sessions one account could hold. A user who repeatedly signs in with their own mailbox password can therefore keep the table full and sign out every webmail and administration session that is idle for more than a short time, for as long as they continue.
A vulnerability exists in Progressive Robot hMailServer versions 6.2.28 through 6.3.5, allowing remote authenticated users to disrupt other users' sessions via the REST API. The issue arises from an uncontrolled eviction process in the browser session table, which is shared across all accounts, including the server administrator and support sessions. When the table reached its capacity of 1,000 sessions, it indiscriminately removed the least recently used session, regardless of ownership, and imposed no limit on the number of sessions an individual account could maintain. This flaw enabled a user to repeatedly log in with their mailbox password, monopolize the session table, and forcibly log out any idle webmail or administrative sessions after a brief period of inactivity.
Users are advised to upgrade to hMailServer version 6.3.6, which addresses this vulnerability by implementing a controlled session management system. Instructions for upgrading are available in the hMailServer release notes for version 6.3.6.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 8, 2026CISA-ADP
Assessed Oct 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.6 | [email protected] | Release NotesVendor |
| https://gitlab.com/hmailserver/hmailserver/-/work_items/62 | [email protected] | Issue TrackingTechnical DescriptionVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Progressive Robot hMailServer | >= 6.2.28, <= 6.3.5 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 8, 2026 | CVE Modified | CISA-ADP |
| Oct 8, 2026 | New CVE Received | [email protected] |