CVE-2026-107573 in hMailServer
Summary
by MITRE • 10/08/2026
Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a local authenticated user to read the mail server's data. The installer created the data, log, temp, database and event folders and the hMailServer.INI configuration file with the permissions inherited from the installation folder, by default under Program Files, which give the local Users group read access. Any user who can sign in to the computer could read every stored message, the logs, the built-in database with the accounts' password hashes whenever the service is stopped, and the configuration file, including the database password, which is sealed only with the machine's DPAPI key and can be unsealed by any local account; with an external database that password gives full control of it. The Linux AppImage of 6.3.0 through 6.3.5 likewise created its per-user data folders readable by other local users.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability identified in Progressive Robot hMailServer versions 6.0.0 through 6.3.5 represents a critical failure in access control configuration during the software installation process, specifically categorized under CWE-276: Incorrect Default Permissions. This flaw arises because the Windows installer fails to restrict file system permissions for sensitive directories and configuration files after deployment. Instead of applying restrictive security descriptors that limit access to only authorized service accounts or administrators, the installer allows these resources to inherit default permissions from their parent directory within Program Files. Consequently, members of the local Users group are granted read access to critical components including mail data folders, log files, temporary storage directories, database locations, and event logs. This misconfiguration effectively exposes sensitive organizational information to any authenticated user on the host system who can successfully sign in.
The operational impact of this vulnerability is severe due to the nature of the exposed assets. An attacker with local access can read every stored email message, compromising confidentiality for all users relying on the mail server. Furthermore, the exposure extends to internal logs and event data which may reveal network topology or user activity patterns. Most critically, the built-in database containing account password hashes is accessible in plaintext if the hMailServer service is stopped at any point during an attack window. Even when the service is running, the configuration file remains vulnerable as it stores the database connection credentials protected only by Windows Data Protection API encryption tied to the local machine key. Since this DPAPI protection can be decrypted by any user with a valid session on that specific computer, the attacker gains access to the plaintext password required for full control of the underlying database engine.
In scenarios where hMailServer is configured to use an external relational database rather than its built-in SQLite backend, the implications escalate significantly. The exposure of the configuration file allows attackers to retrieve the connection string and credentials necessary to authenticate directly against the external database server. This grants the attacker full administrative control over the external data store, potentially leading to further lateral movement or persistent access within the organization's infrastructure. Additionally, this vulnerability is not limited exclusively to Windows environments; Linux AppImage versions 6.3.0 through 6.3.5 exhibit a similar flaw where per-user data folders are created with permissions that allow other local users on the same system to read sensitive application state and configuration details.
From an offensive security perspective, this vulnerability aligns closely with MITRE ATT&CK technique T1078: Valid Accounts, as it leverages legitimate user credentials for unauthorized access, and T1552.004: Unsecured Credentials in Local System Registry or Files, specifically regarding the exposure of configuration files containing secrets. The attack vector is classified as local with low complexity, requiring only physical or remote desktop session access to a compromised endpoint where hMailServer is installed. To mitigate this risk, administrators must immediately audit file system permissions on all directories associated with hMailServer installation and data storage. It is essential to restrict read and write access exclusively to the service account running the application and local administrators, removing inheritance from parent folders that grant broad user group access. For external database configurations, rotating credentials upon remediation is mandatory since they are considered compromised due to their prior exposure in plaintext within accessible configuration files.