CVE-2026-107573 Progressive Robot Ltd CVE debrief

Who should care

System administrators and security teams responsible for managing hMailServer installations, especially in multi-user environments, should assess exposure and prioritize remediation.

Why it matters

CVE-2026-107573 allows local authenticated users to read sensitive mail server data due to incorrect default permissions in hMailServer installations. Defenders should verify and remediate affected installations, especially in multi-user environments, to prevent unauthorized access to mail server data.

• Local authenticated users can read stored messages, logs, and configuration files.
• Users can access accounts' password hashes when the service is stopped.
• The database password, sealed with the machine's DPAPI key, can be unsealed by any local account.
• With an external database, the password gives full control of it.

Technical summary

The Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.5 creates folders and configuration files with inherited permissions from the installation folder, allowing local authenticated users to read mail server data. The installer creates the data, log, temp, database, and event folders and the hMailServer.INI configuration file with the permissions inherited from the installation folder, by default under Program Files, which give the local Users group read access. Any user who can sign in to the computer could read every stored message, the logs, the built-in database with the accounts' password hashes whenever the service is stopped, and the configuration file, including the database password,

Defensive priority

Defenders should prioritize verifying and remediating hMailServer installations, especially in environments with multiple local users.

Recommended defensive actions

• Verify hMailServer installations and configurations to ensure proper permissions.
• Remediate affected installations by updating to version 6.3.6 or later.
• Monitor for potential exploitation attempts and review system logs for unauthorized access.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and references to vendor releases. The vulnerability allows local authenticated users to read sensitive mail server data due to incorrect default permissions in hMailServer installations. The Linux AppImage of 6.3.0 through 6.3.5 also creates per-user data folders readable by other local users. Defenders should verify and remediate affected installations, especially in multi-user environments, to prevent unauthorized data

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.