{"id":"CVE-2026-126624","kind":"vulnerability","aliases":["CVE-2026-126624"],"related":[],"title":"hMailServer: Windows installer lets local users escalate to administrator","description":"Unverified ownership in the Windows installer of Progressive Robot hMailServer 6.3.7 allows a local authenticated user to run code as the mail server's service account or as an administrator when setup installs into, or upgrades, a program folder that accounts other than the administrators could write before, such as one made beforehand at the root of a drive. 6.3.7 fixed CVE-2026-107571 by giving the program folder, Bin and ControlPanel permissions that only administrators may change, but setup refused nothing that was already in them, or in the folders that hold the event script, the add-ons and the database scripts: a program, a library, a script or a settings file that another account owns, or whose own permissions let another account change it, is kept with that owner and those permissions, which the hardening of the folders does not take away. Setup then runs programs from Bin with the administrator's elevated rights, and the service, which runs as LocalSystem or as its virtual account, runs them and the event script, so that a library such an account placed in Bin is loaded in place of the system's; the account can still change the file after the installation. The default installation under Program Files is not affected.","summary":"The Windows installer of hMailServer 6.3.7 trusts program folders that non-administrator accounts could already write to, so a local user can plant files there. Setup then runs those planted programs with administrator rights, and the mail service runs them as its own account.","severity":"high","cvss":7.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hmailserver","mail-server","package","self-hosted","windows"],"not_affected_if":["default-install-path","program-files-install"],"how_to_check":"- Check the install folder on the mail server, for example `dir \"C:\\hMailServer\"`, and look for files owned or writable by non-administrator accounts.\n- Check whether the install or upgrade path sits outside Program Files, such as a folder made at the root of a drive.\n- Confirm the installed version is `6.3.7` or earlier.","fix":"- hMailServer `6.3.7` fixed the folder permissions for Bin and ControlPanel; the sources do not state a version that fixes this specific flaw, so unknown.","status":"open","published_at":"2026-11-11T09:17:14+00:00","first_seen_at":"2026-11-11T09:26:48+00:00","triaged_at":"2026-11-11T09:28:31+00:00","updated_at":"2026-11-11T09:28:31+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-11T09:28:31Z","model":"claude-haiku-5-5","output":{"fix":"- hMailServer `6.3.7` fixed the folder permissions for Bin and ControlPanel; the sources do not state a version that fixes this specific flaw, so unknown.","reach":"local","title":"hMailServer: Windows installer lets local users escalate to administrator","impact":"high","summary":"The Windows installer of hMailServer 6.3.7 trusts program folders that non-administrator accounts could already write to, so a local user can plant files there. Setup then runs those planted programs with administrator rights, and the mail service runs them as its own account.","audience":"businesses","category":"package","nicknames":[],"who_cares":["hmailserver","windows","self-hosted","mail-server"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user runs code as administrator or the mail service account","analyst_note":"Confirm the fixed version for this specific CVE-2026-126624 on the NVD page or the hMailServer vendor advisory, since sources give none.","how_to_check":"- Check the install folder on the mail server, for example `dir \"C:\\hMailServer\"`, and look for files owned or writable by non-administrator accounts.\n- Check whether the install or upgrade path sits outside Program Files, such as a folder made at the root of a drive.\n- Confirm the installed version is `6.3.7` or earlier.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["default-install-path","program-files-install"],"who_is_affected":"Only Windows installs of hMailServer 6.3.7 that were set up or upgraded into a folder that non-administrator accounts could already write to, such as a folder created at the root of a drive. The default installation under Program Files is not affected, and servers without local user accounts that can log on are much less exposed. Teams should look at the install path and the ownership of files in the program folder.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000823,"input_tokens":4815,"output_tokens":683,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-107571':133C '-126624':12A,15A '-2026':11A,14A,132C '6.3.7':30B,80C,129C 'account':38B,69B,95C,110C,186C,194C,238C,251C,264C 'add':168C 'add-on':167C 'administr':9A,37B,58B,99C,114C,145C,223C 'affect':281C 'allow':81C 'alreadi':40B,154C 'anoth':185C,193C 'authent':84C 'away':214C 'beforehand':122C 'bin':139C,220C,254C 'chang':147C,195C,267C 'code':88C 'controlpanel':141C 'could':39B,115C 'cve':10A,13A,131C 'databas':172C 'default':274C 'drive':128C 'elev':225C 'escal':7A 'event':164C,243C 'file':49B,183C,269C,278C 'fix':130C 'folder':33B,108C,138C,160C,210C 'give':135C 'harden':207C 'hmailserv':1A,16B,29B,79C 'hold':162C 'host':23B 'instal':3A,27B,75C,102C,272C,275C 'kept':198C 'let':4A,192C 'librari':177C,248C 'load':256C 'local':5A,45B,83C 'localsystem':233C 'made':121C 'mail':18B,62B,91C 'mail-serv':17B 'may':146C 'non':36B 'non-administr':35B 'noth':151C 'on':169C 'one':120C 'own':187C 'owner':201C 'ownership':71C 'packag':20B 'permiss':142C,191C,204C 'place':252C,258C 'plant':48B,55B 'program':32B,56B,107C,137C,175C,218C,277C 'progress':77C 'refus':150C 'right':59B,226C 'robot':78C 'root':125C 'run':53B,64B,87C,217C,231C,239C 'script':165C,173C,179C,244C 'self':22B 'self-host':21B 'server':19B,92C 'servic':63B,94C,229C 'set':182C 'setup':51B,101C,149C,215C 'still':266C 'system':261C 'take':213C 'trust':31B 'unverifi':70C 'upgrad':105C 'user':6A,46B,85C 'virtual':237C 'whose':189C 'window':2A,24B,26B,74C 'write':41B,116C","nicknames":[],"mitigations":[],"who_affected":"Only Windows installs of hMailServer 6.3.7 that were set up or upgraded into a folder that non-administrator accounts could already write to, such as a folder created at the root of a drive. The default installation under Program Files is not affected, and servers without local user accounts that can log on are much less exposed. Teams should look at the install path and the ownership of files in the program folder.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","hmailserver","mailserver","package","selfhosted","windows"],"campaign_type":null,"search_a":"'-126624':12A,15A '-2026':11A,14A 'administr':9A 'cve':10A,13A 'escal':7A 'hmailserv':1A 'instal':3A 'let':4A 'local':5A 'user':6A 'window':2A","search_b":"'6.3.7':30B 'account':38B,69B 'administr':37B,58B 'alreadi':40B 'could':39B 'file':49B 'folder':33B 'hmailserv':16B,29B 'host':23B 'instal':27B 'local':45B 'mail':18B,62B 'mail-serv':17B 'non':36B 'non-administr':35B 'packag':20B 'plant':48B,55B 'program':32B,56B 'right':59B 'run':53B,64B 'self':22B 'self-host':21B 'server':19B 'servic':63B 'setup':51B 'trust':31B 'user':46B 'window':24B,26B 'write':41B","search_c":"'-107571':133C '-2026':132C '6.3.7':80C,129C 'account':95C,110C,186C,194C,238C,251C,264C 'add':168C 'add-on':167C 'administr':99C,114C,145C,223C 'affect':281C 'allow':81C 'alreadi':154C 'anoth':185C,193C 'authent':84C 'away':214C 'beforehand':122C 'bin':139C,220C,254C 'chang':147C,195C,267C 'code':88C 'controlpanel':141C 'could':115C 'cve':131C 'databas':172C 'default':274C 'drive':128C 'elev':225C 'event':164C,243C 'file':183C,269C,278C 'fix':130C 'folder':108C,138C,160C,210C 'give':135C 'harden':207C 'hmailserv':79C 'hold':162C 'instal':75C,102C,272C,275C 'kept':198C 'let':192C 'librari':177C,248C 'load':256C 'local':83C 'localsystem':233C 'made':121C 'mail':91C 'may':146C 'noth':151C 'on':169C 'one':120C 'own':187C 'owner':201C 'ownership':71C 'permiss':142C,191C,204C 'place':252C,258C 'program':107C,137C,175C,218C,277C 'progress':77C 'refus':150C 'right':226C 'robot':78C 'root':125C 'run':87C,217C,231C,239C 'script':165C,173C,179C,244C 'server':92C 'servic':94C,229C 'set':182C 'setup':101C,149C,215C 'still':266C 'system':261C 'take':213C 'unverifi':70C 'upgrad':105C 'user':85C 'virtual':237C 'whose':189C 'window':74C 'write':116C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T09:17:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","cvss_by":"cve@gitlab.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126624","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126624","severity":null,"published_at":"2026-11-11T09:17:14+00:00","modified_at":"2026-11-11T09:17:14+00:00","first_seen_at":"2026-11-11T09:26:48+00:00","fetched_at":"2026-11-11T09:26:48+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}