CVE-2026-126622 · Package
NO FIX YET · SEE WHAT TO DO
The Windows installer of hMailServer 6.3.7 sets default permissions that let a local user who can write to an existing install folder plant a library that setup then runs with administrator rights. An attacker who is already logged in on the machine can get code running as the administrator who runs setup.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only machines where hMailServer was installed, upgraded or repaired into a pre-existing folder that ordinary users could write, such as a folder created at a drive root. The default installation under Program Files, where ordinary users only have read and execute, is not affected. The attacker needs a local account on the machine.
Not affected if default-install-path, managed-hosting
Who cares hmailserver, self-hosted, windows
C:\Program Files\hMailServer for the default location; a folder created at the root of a drive that ordinary users can write to is the affected case.Bin and ControlPanel subfolders for non-administrator accounts.Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.3.7 allow a local authenticated user to run code as the administrator who runs setup, when the server is installed into a program folder that is already there and that accounts other than the administrators could write, such as a folder made beforehand at the root of a drive, or when such an installation is upgraded or repaired. 6.3.7 fixed CVE-2026-107571 by giving the program folder, Bin and ControlPanel permissions that only administrators may change, but for a folder that is already there it does so only at the end of setup: setup first copies the programs into Bin, which every user may still write, and runs programs from Bin with the administrator's elevated rights, registering the service among them, before that hardening, so that a library another account places in Bin meanwhile is loaded in place of the system's. A handle an account opened on such a folder while it could write it keeps that access after the hardening. The default installation under Program Files, whose folders give ordinary users read and execute only, is not affected.
This page as .md · .json · CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.