Insecure default permissions in hMailServer expose mail data locally
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
Progressive Robot hMailServer from 6.0.0 before 6.3.6 has incorrect default permissions (CWE-276) on Windows, where the installer leaves data folders and hMailServer.INI readable by local Users. A local authenticated user can read all stored messages, logs, the database with account password hashes while the service is stopped, and the configuration file with the database password. The Linux AppImage of 6.3.0 through 6.3.5 likewise creates per-user data folders readable by other local users.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a local authenticated user to read the mail server's data. The installer created the data, log, temp, database and event folders and the hMailServer.INI configuration file with the permissions inherited from the installation folder, by default under Program Files, which give the local Users group read access. Any user who can sign in to the computer could read every stored message, the logs, the built-in database with the accounts' password hashes whenever the service is stopped, and the configuration file, including the database password, which is sealed only with the machine's DPAPI key and can be unsealed by any local account; with an external database that password gives full control of it. The Linux AppImage of 6.3.0 through 6.3.5 likewise created its per-user data folders readable by other local users.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Progressive Robot Ltd | hMailServer | 6.0.0 to before 6.3.6 | 6.3.6 | Patch available | CNA |
- hMailServer VendorProgressive Robot Ltd Affected 6.0.0 to before 6.3.6 Fixed in 6.3.6 Patch available CNA
Remediation
Update hMailServer to version 6.3.6, which is the fixed version listed for the affected range.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · CNA hMailServer (Progressive Robot Ltd) Fixed in 6.3.6
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Progressive Robot hMailServer 6.3.6
23 records Highest priority Priority LOW 23 LOW
Other records, highest priority first
- TI-2026-69567 Inefficient processing in hMailServer stalls mail deliveryPriority LOW 39
- TI-2026-69565 Infinite loop in hMailServer MIME handling lets attackers stop mailPriority LOW 39
- TI-2026-69564 Inefficient DKIM and ARC checks in hMailServer cause denial of servicePriority LOW 39
Timeline
- 2026-10-08 Threatist record created from CVE-2026-107573
References
More Progressive Robot Ltd vulnerabilities
- TI-2026-64884 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in hMailServer CVSS 3.1CRITICAL 9.8
- TI-2026-76418 Unchecked loop limit in hMailServer lets remote attackers stop mail CVSS 3.1HIGH 7.5
- TI-2026-69567 Inefficient processing in hMailServer stalls mail delivery CVSS 3.1HIGH 7.5
- TI-2026-69565 Infinite loop in hMailServer MIME handling lets attackers stop mail CVSS 3.1HIGH 7.5
- TI-2026-69564 Inefficient DKIM and ARC checks in hMailServer cause denial of service CVSS 3.1HIGH 7.5
- TI-2026-69562 Inefficient JSON parsing in hMailServer lets attackers halt mail CVSS 3.1HIGH 7.5
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences