{"id":"CVE-2026-126622","kind":"vulnerability","aliases":["CVE-2026-126622"],"related":[],"title":"hMailServer: Windows installer lets local users run code as admin","description":"Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.3.7 allow a local authenticated user to run code as the administrator who runs setup, when the server is installed into a program folder that is already there and that accounts other than the administrators could write, such as a folder made beforehand at the root of a drive, or when such an installation is upgraded or repaired. 6.3.7 fixed CVE-2026-107571 by giving the program folder, Bin and ControlPanel permissions that only administrators may change, but for a folder that is already there it does so only at the end of setup: setup first copies the programs into Bin, which every user may still write, and runs programs from Bin with the administrator's elevated rights, registering the service among them, before that hardening, so that a library another account places in Bin meanwhile is loaded in place of the system's. A handle an account opened on such a folder while it could write it keeps that access after the hardening. The default installation under Program Files, whose folders give ordinary users read and execute only, is not affected.","summary":"The Windows installer of hMailServer 6.3.7 sets default permissions that let a local user who can write to an existing install folder plant a library that setup then runs with administrator rights. An attacker who is already logged in on the machine can get code running as the administrator who runs setup.","severity":"high","cvss":7.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hmailserver","package","self-hosted","windows"],"not_affected_if":["default-install-path","managed-hosting"],"how_to_check":"- Check the installed hMailServer version and the folder it was installed into, such as `C:\\Program Files\\hMailServer` for the default location; a folder created at the root of a drive that ordinary users can write to is the affected case.\n- Inspect the write permissions on the install folder and its `Bin` and `ControlPanel` subfolders for non-administrator accounts.","fix":"- hMailServer 6.3.7 is the affected release; the sources do not name a fixed version for this CVE.","status":"open","published_at":"2026-11-11T09:17:14+00:00","first_seen_at":"2026-11-11T09:26:48+00:00","triaged_at":"2026-11-11T09:28:35+00:00","updated_at":"2026-11-11T09:28:35+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-11T09:28:35Z","model":"claude-haiku-5-5","output":{"fix":"- hMailServer 6.3.7 is the affected release; the sources do not name a fixed version for this CVE.","reach":"local","title":"hMailServer: Windows installer lets local users run code as admin","impact":"high","summary":"The Windows installer of hMailServer 6.3.7 sets default permissions that let a local user who can write to an existing install folder plant a library that setup then runs with administrator rights. An attacker who is already logged in on the machine can get code running as the administrator who runs setup.","audience":"businesses","category":"package","nicknames":[],"who_cares":["hmailserver","windows","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user runs code as the administrator running setup","analyst_note":"Confirm the fixed hMailServer version and any vendor-stated remediation for CVE-2026-126622 from the vendor advisory or NVD.","how_to_check":"- Check the installed hMailServer version and the folder it was installed into, such as `C:\\Program Files\\hMailServer` for the default location; a folder created at the root of a drive that ordinary users can write to is the affected case.\n- Inspect the write permissions on the install folder and its `Bin` and `ControlPanel` subfolders for non-administrator accounts.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["default-install-path","managed-hosting"],"who_is_affected":"Only machines where hMailServer was installed, upgraded or repaired into a pre-existing folder that ordinary users could write, such as a folder created at a drive root. The default installation under Program Files, where ordinary users only have read and execute, is not affected. The attacker needs a local account on the machine.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000792,"input_tokens":4787,"output_tokens":627,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-107571':148C '-126622':13A,16A '-2026':12A,15A,147C '6.3.7':28B,86C,144C 'access':246C 'account':116C,217C,233C 'admin':10A 'administr':53B,71B,97C,120C,160C,200C 'affect':267C 'allow':87C 'alreadi':59B,112C,169C 'among':207C 'anoth':216C 'attack':56B 'authent':90C 'beforehand':128C 'bin':154C,186C,197C,220C 'chang':162C 'code':8A,67B,94C 'controlpanel':156C 'copi':182C 'could':121C,241C 'cve':11A,14A,146C 'default':30B,76C,251C 'drive':134C 'elev':202C 'end':177C 'everi':188C 'execut':263C 'exist':42B 'file':255C 'first':181C 'fix':145C 'folder':44B,109C,126C,153C,166C,238C,257C 'get':66B 'give':150C,258C 'handl':231C 'harden':211C,249C 'hmailserv':1A,17B,27B,85C 'host':21B 'incorrect':75C 'instal':3A,25B,43B,81C,105C,139C,252C 'keep':244C 'let':4A,33B 'librari':47B,215C 'load':223C 'local':5A,35B,89C 'log':60B 'machin':64B 'made':127C 'may':161C,190C 'meanwhil':221C 'open':234C 'ordinari':259C 'packag':18B 'permiss':31B,77C,157C 'place':218C,225C 'plant':45B 'program':108C,152C,184C,195C,254C 'progress':83C 'read':261C 'regist':204C 'repair':143C 'right':54B,203C 'robot':84C 'root':131C 'run':7A,51B,68B,73B,93C,99C,194C 'self':20B 'self-host':19B 'server':103C 'servic':206C 'set':29B 'setup':49B,74B,100C,179C,180C 'still':191C 'system':228C 'upgrad':141C 'user':6A,36B,91C,189C,260C 'whose':256C 'window':2A,22B,24B,80C 'write':39B,122C,192C,242C","nicknames":[],"mitigations":[],"who_affected":"Only machines where hMailServer was installed, upgraded or repaired into a pre-existing folder that ordinary users could write, such as a folder created at a drive root. The default installation under Program Files, where ordinary users only have read and execute, is not affected. The attacker needs a local account on the machine.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","hmailserver","package","selfhosted","windows"],"campaign_type":null,"search_a":"'-126622':13A,16A '-2026':12A,15A 'admin':10A 'code':8A 'cve':11A,14A 'hmailserv':1A 'instal':3A 'let':4A 'local':5A 'run':7A 'user':6A 'window':2A","search_b":"'6.3.7':28B 'administr':53B,71B 'alreadi':59B 'attack':56B 'code':67B 'default':30B 'exist':42B 'folder':44B 'get':66B 'hmailserv':17B,27B 'host':21B 'instal':25B,43B 'let':33B 'librari':47B 'local':35B 'log':60B 'machin':64B 'packag':18B 'permiss':31B 'plant':45B 'right':54B 'run':51B,68B,73B 'self':20B 'self-host':19B 'set':29B 'setup':49B,74B 'user':36B 'window':22B,24B 'write':39B","search_c":"'-107571':148C '-2026':147C '6.3.7':86C,144C 'access':246C 'account':116C,217C,233C 'administr':97C,120C,160C,200C 'affect':267C 'allow':87C 'alreadi':112C,169C 'among':207C 'anoth':216C 'authent':90C 'beforehand':128C 'bin':154C,186C,197C,220C 'chang':162C 'code':94C 'controlpanel':156C 'copi':182C 'could':121C,241C 'cve':146C 'default':76C,251C 'drive':134C 'elev':202C 'end':177C 'everi':188C 'execut':263C 'file':255C 'first':181C 'fix':145C 'folder':109C,126C,153C,166C,238C,257C 'give':150C,258C 'handl':231C 'harden':211C,249C 'hmailserv':85C 'incorrect':75C 'instal':81C,105C,139C,252C 'keep':244C 'librari':215C 'load':223C 'local':89C 'made':127C 'may':161C,190C 'meanwhil':221C 'open':234C 'ordinari':259C 'permiss':77C,157C 'place':218C,225C 'program':108C,152C,184C,195C,254C 'progress':83C 'read':261C 'regist':204C 'repair':143C 'right':203C 'robot':84C 'root':131C 'run':93C,99C,194C 'server':103C 'servic':206C 'setup':100C,179C,180C 'still':191C 'system':228C 'upgrad':141C 'user':91C,189C,260C 'whose':256C 'window':80C 'write':122C,192C,242C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T09:17:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","cvss_by":"cve@gitlab.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126622","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126622","severity":null,"published_at":"2026-11-11T09:17:14+00:00","modified_at":"2026-11-11T09:17:14+00:00","first_seen_at":"2026-11-11T09:26:48+00:00","fetched_at":"2026-11-11T09:26:48+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}