Vulnerability in hMailServer 6.3.7 Allows Local Authenticated Users to Run Code as Admin
CVE-2026-126625

6.7MEDIUM

Key Information:

Vendor

Progressive Robot Ltd

Status
Hmailserver
Vendor
CVE Published:
11 November 2026

What is CVE-2026-126625?

A vulnerability in the Windows installer of hMailServer version 6.3.7 allows local authenticated users to execute code with administrator privileges. This occurs due to improper default permissions set during installation in writable locations, such as the root of a drive. During installation, a new program folder is created with inherited permissions from the directory above, allowing unauthorized accounts to place files and folders within it. Even after the installation process attempts to restrict access to this folder, any files placed there retain the original user's ownership. Subsequently, programs executed from this folder operate under elevated rights, posing a significant security risk.

Affected Version(s)

hMailServer 6.3.7

References

https://gitlab.com/hmailserver/hmailserver/-/work_items/78
https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8
https://www.cve.org/CVERecord?id=CVE-2026-107571

CVSS V3.1

Score:
6.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Found by the hMailServer project (Progressive Robot Ltd)
.