SQL Injection Vulnerability in Progressive Robot hMailServer Software
CVE-2026-126619

4.8MEDIUM

Key Information:

Vendor

Progressive Robot Ltd

Status
Hmailserver
Vendor
CVE Published:
11 November 2026

What is CVE-2026-126619?

The SQL injection vulnerability in Progressive Robot hMailServer versions 6.0.0-B1 to 6.3.7 allows a remote attacker to exploit misinterpretation of SQL statement text, leading to a false report of successful database writes when, in reality, they fail. This flaw is triggered by the '[IGNORE-ERRORS]' marker within SQL statements, which was initially mismanaged across different database engines. As a result, a multitude of operations, such as message deliveries or IP bans, may be inaccurately logged as successful with no actual changes made to the database, leaving sensitive operations unmonitored. Consequently, this can result in loss of data integrity, security risks, and untraceable attacks, particularly affecting mail delivery and server logging mechanisms.

Affected Version(s)

hMailServer 6.0.0-B1 <= 6.3.7

References

https://gitlab.com/hmailserver/hmailserver/-/work_items/100
https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Found by the hMailServer project (Progressive Robot Ltd)
.