Progressive Robot hMailServer up to 6.3.5 Installer hMailServer.INI permission

Summaryinfo

A vulnerability has been found in Progressive Robot hMailServer up to 6.3.5 and classified as critical. This vulnerability affects unknown code of the file hMailServer.INI of the component Installer. Performing a manipulation results in permission. This vulnerability is identified as CVE-2026-107573. The attack is only possible with local access. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as critical has been found in Progressive Robot hMailServer up to 6.3.5. This affects an unknown part of the file hMailServer.INI of the component Installer. The manipulation with an unknown input leads to a permission vulnerability. CWE is classifying the issue as CWE-275. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a local authenticated user to read the mail server's data. The installer created the data, log, temp, database and event folders and the hMailServer.INI configuration file with the permissions inherited from the installation folder, by default under Program Files, which give the local Users group read access. Any user who can sign in to the computer could read every stored message, the logs, the built-in database with the accounts' password hashes whenever the service is stopped, and the configuration file, including the database password, which is sealed only with the machine's DPAPI key and can be unsealed by any local account; with an external database that password gives full control of it. The Linux AppImage of 6.3.0 through 6.3.5 likewise created its per-user data folders readable by other local users.

The advisory is shared at gitlab.com. This vulnerability is uniquely identified as CVE-2026-107573 since 10/08/2026. The exploitability is told to be easy. An attack has to be approached locally. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1222 for this issue.

By approaching the search of inurl:hMailServer.INI it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 6.3.6 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Mail Server Software

Vendor

• Progressive Robot

Name

• hMailServer

Version

• 6.3.0
• 6.3.1
• 6.3.2
• 6.3.3
• 6.3.4
• 6.3.5

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion