CVE-2026-7807 in SmarterMail
Summary
by MITRE • 05/08/2026
SmarterTools SmarterMail builds prior to 9560 contain a local file inclusion vulnerability in the /api/v1/report/summary/{type} API endpoint that allows authenticated users to read arbitrary .json files on the system. Attackers can exploit this vulnerability combined with weak encryption algorithms and hardcoded keys to decrypt and access stored passwords and 2FA secrets for all users.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 06/04/2026
This vulnerability exists within SmarterTools SmarterMail software versions prior to 9560 where the /api/v1/report/summary/{type} endpoint fails to properly validate user input parameters. The flaw represents a classic local file inclusion vulnerability that allows authenticated users to manipulate the type parameter to traverse the file system and read arbitrary .json files. This issue falls under CWE-22 which specifically addresses improper limitation of a pathname to a restricted directory. The vulnerability is particularly dangerous because it requires only authentication to exploit, meaning that any user with valid credentials can potentially access sensitive system files that should remain protected.
The operational impact of this vulnerability extends far beyond simple file reading capabilities. When combined with the presence of weak encryption algorithms and hardcoded cryptographic keys within the application, attackers can escalate their privileges significantly. The system stores user credentials and two-factor authentication secrets in encrypted formats, but due to the weak encryption implementation, these protections can be easily bypassed. This creates a cascading security failure where the initial LFI vulnerability leads to credential exposure, potentially allowing attackers to gain full administrative control over the mail server and all associated user accounts.
The exploitation chain begins with an authenticated user accessing the vulnerable API endpoint and manipulating the type parameter to read system configuration files containing the hardcoded encryption keys. Once these keys are obtained, attackers can decrypt stored passwords and 2FA secrets from the database files, effectively compromising all user accounts. This vulnerability aligns with ATT&CK technique T1552.001 which covers "Unsecured Credentials" and T1078.004 which addresses "Valid Accounts" as attackers can leverage legitimate user credentials to access the system and then escalate their access. The weakness demonstrates poor secure coding practices and inadequate input sanitization that violates fundamental security principles.
Organizations should immediately upgrade to SmarterMail version 9560 or later where this vulnerability has been patched through proper input validation and parameter sanitization. Additional mitigations include implementing network segmentation to limit access to the API endpoints, monitoring for unusual API access patterns, and regularly auditing encryption key usage. System administrators should also review and rotate all stored credentials and 2FA secrets immediately, as the compromise of these keys could allow attackers to maintain persistent access to the system. The vulnerability highlights the importance of proper access control mechanisms and the dangers of hardcoded cryptographic material in applications.