CVE-2026-103647 Progressive Robot Ltd CVE debrief

Who should care

Defenders responsible for Progressive Robot hMailServer deployments, particularly those with webmail enabled, should assess exposure and verify user interactions with encrypted messages.

Why it matters

Defenders should prioritize verifying exposure of hMailServer webmail and assessing user interactions with encrypted messages, especially those with attachments declared as text/html, to prevent potential unauthorized access and script-based attacks.

• Potential unauthorized access to user mailboxes
• Possible manipulation of user accounts through the REST API
• Potential for script-based attacks on the webmail origin
• Verification of user interactions with encrypted messages and attachments

Technical summary

The vulnerability exists in the webmail of Progressive Robot hMailServer versions 6.3.2 through 6.3.5. An attacker can exploit this vulnerability by sending a user an encrypted message with an attachment declared as text/html, which can be rendered as a document in the webmail's origin when opened in a new tab, potentially allowing the script to read the mailbox, send mail, and change the account through the REST API. Defenders should prioritize verifying exposure of hMailServer webmail and assessing user interactions with encrypted messages, especially those with attachments declared as text/html.

Defensive priority

Defenders should prioritize verifying exposure of hMailServer webmail and assessing user interactions with encrypted messages, especially those with attachments declared as text/html.

Recommended defensive actions

• Verify hMailServer version and exposure of webmail
• Assess user interactions with encrypted messages and attachments
• Implement compensating controls to monitor and restrict user actions
• Consider upgrading to version 6.3.6 or later
• Review relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including affected versions and a description of the attack vector. Defenders should verify hMailServer version and exposure of webmail, assess user interactions with encrypted messages and attachments, and implement compensating controls to monitor and restrict user actions. The vulnerability exists in versions 6.3.2 through 6.3.5. Evidence is limited to CVE and source item details.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.