CVE-2026-107571

Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.6 allow a local authenticated user to run code as the mail server's high-privileged accounts when the product is installed in a folder whose permissions are inherited from a writable parent, such as the root of a drive. The installer places the server's programs in the Bin folder of the program folder and gives neither the program folder nor Bin any permissions of their own, so they inherit the parent's. Under the default location, Program Files, ordinary users receive only read and execute and the configuration is not affected; but the installer accepts any path without warning, and a program folder at the root of an NTFS volume inherits write access for a broad group - Authenticated Users (Modify) on a Windows client, Users (create files and folders) on Windows Server. A local user without administrator rights can then alter or replace the service program, which runs as LocalSystem or as the service's virtual account, or the programs an administrator runs elevated from Bin during setup and maintenance, or place a library in Bin that those programs load in place of the system copy, gaining code execution with those privileges. The default Program Files installation is not affected.

• CWE-276

• https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.7
• https://gitlab.com/hmailserver/hmailserver/-/work_items/78

Published

Oct 19, 2026

Last Modified

Oct 20, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-107566Missing authorization in the Sieve editheader action (6.2.22…6.5
• CVE-2026-107567Use of a less trusted source in the DKIM signing of Progress…7.5
• CVE-2026-107568Missing authorization in the Sieve notify action (6.2.22 thr…6.5
• CVE-2026-107569Unchecked input for a loop condition in Progressive Robot hM…7.5
• CVE-2026-10757There is a SQL injection vulnerability in Esri ArcGIS Server…9.8
• CVE-2026-107570heap OOB write in convert_file_from_to() via a crafted Conte…2.5
• CVE-2026-107572Inefficient complexity in the Sieve filter evaluation of Pro…6.5
• CVE-2026-107573Incorrect default permissions in the Windows installer of Pr…7.8
• CVE-2026-107574Inefficient algorithmic complexity in the JSON reader of Pro…7.5
• CVE-2026-107575Inefficient algorithmic complexity in the SPF macro expansio…5.3
• CVE-2026-107576Inefficient algorithmic complexity in the inbound DKIM and A…7.5
• CVE-2026-107577Inefficient algorithmic complexity and a non-terminating loo…7.5