CVE-2026-107571: CWE-276: Incorrect Default Permissions in Progressive Robot Ltd hMailServer

The vulnerability arises from the Windows installer of hMailServer versions 6.0.0 through 6.3.6, which installs server programs into a Bin folder without setting explicit permissions. If the installation folder inherits write permissions from a writable parent directory (e.g., the root of an NTFS volume), local authenticated users can modify or replace executable files or libraries. Since these programs run with high privileges (LocalSystem or service virtual account), this leads to privilege escalation and arbitrary code execution. The default installation path under Program Files is secure because it restricts write access, but the installer allows installation in any path without warning, exposing the risk.

A local authenticated user can escalate privileges by executing arbitrary code with the mail server's high-privileged accounts. This includes the ability to modify or replace service programs running as LocalSystem or the service's virtual account, or to place malicious libraries loaded by elevated setup and maintenance programs. The impact includes full system compromise on affected installations where the folder permissions are insecurely inherited.

No official patch or fix is currently documented. Users should ensure that hMailServer is installed only in directories with secure permissions, such as the default Program Files folder, which restricts write access to ordinary users. Avoid installing the software in folders whose permissions are inherited from writable parent directories, especially the root of a drive. Monitor vendor advisories for any forthcoming official fixes or updates.