CVE-2026-107586 in hMailServer
Summary
by MITRE • 10/08/2026
Uncontrolled eviction in the browser session table of the REST API in Progressive Robot hMailServer 6.2.28 through 6.3.5 allows a remote authenticated user to end other users' sessions. The table of browser sessions, shared by every account, the server administrator and support sessions, dropped its least recently used session whenever it was full, whoever it belonged to, and placed no limit on how many sessions one account could hold. A user who repeatedly signs in with their own mailbox password can therefore keep the table full and sign out every webmail and administration session that is idle for more than a short time, for as long as they continue.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability identified in hMailServer versions 6.2.28 through 6.3.5 represents a critical flaw within the application layer of its REST API implementation, specifically concerning the management of browser session states. This issue stems from an uncontrolled eviction mechanism embedded in the server's internal session table architecture. The core technical deficiency lies in how the system handles resource allocation and lifecycle management for user sessions. Rather than implementing fair access controls or per-user limits on concurrent active connections, the application utilizes a global Least Recently Used (LRU) cache strategy that applies uniformly across all account types. This includes standard end-user mailboxes, administrative accounts, and even internal support sessions. When this shared session table reaches its maximum capacity, the system automatically discards the oldest inactive entry to make room for new connections without regard for the identity or privilege level of the user associated with that entry.
From a technical perspective, this design choice creates a severe availability risk through resource exhaustion techniques. Because there is no upper bound on the number of sessions a single authenticated account can maintain simultaneously, an attacker can exploit this by repeatedly authenticating and keeping their own session entries active within the table. By maintaining these persistent connections, the attacker effectively fills the global session cache with legitimate-looking but idle or short-lived entries belonging to themselves. As new login attempts are processed, whether from other users or administrative staff, the system is forced to evict existing sessions to accommodate them. Due to the LRU policy and the lack of priority weighting for high-privilege accounts, these eviction events frequently target active sessions belonging to legitimate administrators or other end-users who have been idle for a brief period. This results in an unintended denial of service condition where valid users are abruptly logged out without their consent or knowledge.
The operational impact of this vulnerability is significant, particularly regarding the integrity and availability of administrative functions. Since hMailServer relies on web-based interfaces for both routine user mail access and critical server administration, the ability to forcibly terminate these sessions disrupts ongoing operations. An attacker can effectively lock administrators out of their management consoles by continuously cycling through login states that trigger session evictions. This not only causes service disruption but also potentially obscures malicious activities performed during periods when administrative oversight is compromised due to forced logouts. Furthermore, this behavior violates the principle of least privilege and fair resource allocation, as a low-privileged user account can exert disproportionate influence over high-privileged system resources simply by consuming session table slots.
In terms of industry classification standards, this vulnerability aligns with CWE-787: Out-of-bounds Write in contexts where memory or state management is mishandled, though more accurately it falls under CWE-400: Uncontrolled Resource Consumption and CWE-613: Insufficient Session Expiration. The attack vector allows for remote exploitation by an authenticated user, which maps to MITRE ATT&CK technique T1529: System Shutdown or Reboot in the context of availability impact, although specifically it relates more closely to resource exhaustion tactics often seen in Denial of Service attacks. It also touches upon CWE-640: Weak Key Management if one considers session tokens as keys to access state, but primarily it is a logic flaw related to concurrency and state management.
To mitigate this vulnerability, immediate action should be taken by upgrading hMailServer to a version that addresses these session handling flaws or applying vendor-provided patches if available. Administrators must ensure that the application enforces strict limits on the number of concurrent sessions per user account, preventing any single entity from monopolizing global resources. Implementing rate limiting for authentication attempts and introducing weighted eviction policies that prioritize high-privilege administrative sessions over standard user sessions would also help mitigate the impact. Additionally, monitoring session table usage metrics can provide early warning signs of such abuse patterns, allowing for proactive intervention before service disruption occurs.