Unverified Ownership Vulnerability in Progressive Robot hMailServer by hMailServer
CVE-2026-126624

7.3HIGH

Key Information:

Vendor

Progressive Robot Ltd

Status
Hmailserver
Vendor
CVE Published:
11 November 2026

What is CVE-2026-126624?

The unverified ownership vulnerability in Progressive Robot hMailServer 6.3.7 allows a local authenticated user to execute code with elevated privileges. This occurs when the installation or upgrade is directed to a program folder that non-administrative accounts can access, which was not adequately secured. Despite improvements made to permissions in version 6.3.7, any scripts or libraries owned by lower-privileged accounts can still execute, allowing potential malicious manipulation. Notably, the default install path under Program Files remains unaffected, emphasizing the importance of secure folder permissions during setup.

Affected Version(s)

hMailServer 6.3.7

References

https://gitlab.com/hmailserver/hmailserver/-/work_items/78
https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8
https://www.cve.org/CVERecord?id=CVE-2026-107571

CVSS V3.1

Score:
7.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Found by the hMailServer project (Progressive Robot Ltd)
.