CVE-2026-107573

Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a local authenticated user to read the mail server's data. The installer created the data, log, temp, database and event folders and the hMailServer.INI configuration file with the permissions inherited from the installation folder, by default under Program Files, which give the local Users group read access. Any user who can sign in to the computer could read every stored message, the logs, the built-in database with the accounts' password hashes whenever the service is stopped, and the configuration file, including the database password, which is sealed only with the machine's DPAPI key and can be unsealed by any local account; with an external database that password gives full control of it. The Linux AppImage of 6.3.0 through 6.3.5 likewise created its per-user data folders readable by other local users.

• CWE-276

• https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.6
• https://gitlab.com/hmailserver/hmailserver/-/work_items/77

Published

Oct 8, 2026

Last Modified

Oct 8, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-10753The Site Kit by Google WordPress plugin before 1.176.0 does…2.7
• CVE-2026-10754Pega Platform versions 8.5.0 through 25.1.2 are affected by …8.6
• CVE-2026-10755The All in One SEO WordPress plugin before 4.9.9 does not c…2.7
• CVE-2026-107565A flaw was found in luksmeta. A local attacker with administ…5.1
• CVE-2026-107570heap OOB write in convert_file_from_to() via a crafted Conte…2.5
• CVE-2026-107572Inefficient complexity in the Sieve filter evaluation of Pro…6.5
• CVE-2026-107574Inefficient algorithmic complexity in the JSON reader of Pro…7.5
• CVE-2026-107575Inefficient algorithmic complexity in the SPF macro expansio…5.3
• CVE-2026-107576Inefficient algorithmic complexity in the inbound DKIM and A…7.5
• CVE-2026-107577Inefficient algorithmic complexity and a non-terminating loo…7.5
• CVE-2026-107578Improper link resolution and external control of file paths …6.7
• CVE-2026-107579Inefficient algorithmic complexity in the bounce and complai…7.5