CVE-2026-104660: CWE-862: Missing Authorization in Progressive Robot Ltd hMailServer

The vulnerability in hMailServer 6.0.0 through 6.3.5 involves missing authorization checks on COM objects. The service registers COM classes with no DCOM access or launch permissions and initializes security without a descriptor, allowing any local user logged in interactively or via Remote Desktop to activate these COM classes. Objects such as hMailServer.Message, Attachments, Attachment, and FetchAccount created this way carry credentials without authentication. Methods Attachments.Add(path) and Attachment.SaveAs(path) perform no authorization checks, enabling arbitrary file read/write as the service account. Message.Save allows queuing outbound mail from any sender, bypassing SMTP checks. FetchAccount can attach mail-fetch jobs to any mailbox. The service does not impersonate the COM caller, so these actions execute with the service account's privileges, potentially SYSTEM on LocalSystem installations. The vulnerability affects versions >=6.0.0 and <6.3.6.

An attacker with local interactive access can read and write arbitrary files with the privileges of the hMailServer service account, which may be SYSTEM on some installations, leading to potential full system compromise. They can also queue outbound mail as any sender, bypassing SMTP checks, and attach mail-fetch jobs to any mailbox. This results in confidentiality, integrity, and availability impacts rated high.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local interactive access to trusted users only. Monitor for unusual local activity and consider limiting service account privileges as a temporary mitigation.