Sensitive Information Leakage in hMailServer's SMTP Server
CVE-2026-114471
4.7MEDIUM
What is CVE-2026-114471?
The SMTP server of hMailServer versions 6.0.0 through 6.3.6 has a security flaw that allows for the accidental logging of sensitive credentials. When logging is enabled, the server may not adequately protect certain authentication credentials, allowing a local user with access to the logs—or anyone receiving a copy of these logs—to gain access to critical information such as PLAIN passwords, OAuth tokens, and GSSAPI authenticators. For users on Windows versions prior to 6.3.6, the logging directory is readable by all local users, further increasing the risk of unauthorized access.
Affected Version(s)
hMailServer 6.0.0 <= 6.3.6
References
CVSS V3.1
Score:
4.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Upstream hMailServer, whose public issue 654 reported the same flaw in its own SMTP log and whose pull requests 656 and 661 fixed it; found and fixed in this fork by the hMailServer project's triage of it (Progressive Robot Ltd)