CVE-2026-126624 · Package
NO FIX YET · SEE WHAT TO DO
The Windows installer of hMailServer 6.3.7 trusts program folders that non-administrator accounts could already write to, so a local user can plant files there. Setup then runs those planted programs with administrator rights, and the mail service runs them as its own account.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only Windows installs of hMailServer 6.3.7 that were set up or upgraded into a folder that non-administrator accounts could already write to, such as a folder created at the root of a drive. The default installation under Program Files is not affected, and servers without local user accounts that can log on are much less exposed. Teams should look at the install path and the ownership of files in the program folder.
Not affected if default-install-path, program-files-install
Who cares hmailserver, mail-server, self-hosted, windows
dir "C:\hMailServer", and look for files owned or writable by non-administrator accounts.6.3.7 or earlier.6.3.7 fixed the folder permissions for Bin and ControlPanel; the sources do not state a version that fixes this specific flaw, so unknown.Unverified ownership in the Windows installer of Progressive Robot hMailServer 6.3.7 allows a local authenticated user to run code as the mail server's service account or as an administrator when setup installs into, or upgrades, a program folder that accounts other than the administrators could write before, such as one made beforehand at the root of a drive. 6.3.7 fixed CVE-2026-107571 by giving the program folder, Bin and ControlPanel permissions that only administrators may change, but setup refused nothing that was already in them, or in the folders that hold the event script, the add-ons and the database scripts: a program, a library, a script or a settings file that another account owns, or whose own permissions let another account change it, is kept with that owner and those permissions, which the hardening of the folders does not take away. Setup then runs programs from Bin with the administrator's elevated rights, and the service, which runs as LocalSystem or as its virtual account, runs them and the event script, so that a library such an account placed in Bin is loaded in place of the system's; the account can still change the file after the installation. The default installation under Program Files is not affected.
This page as .md · .json · CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.