CVE-2026-107573: CWE-276: Incorrect Default Permissions in Progressive Robot Ltd hMailServer

The vulnerability arises from incorrect default permissions set by the Windows installer of hMailServer versions 6.0.0 through 6.3.5. The installer creates data, log, temp, database, and event folders, as well as the hMailServer.INI configuration file, inheriting permissions from the installation folder under Program Files, which grants read access to the local Users group. Consequently, any local authenticated user can read all stored messages, logs, the built-in database containing password hashes (when the service is stopped), and the configuration file including the database password. The database password is protected only by the machine's DPAPI key, which any local user can unseal. For installations using an external database, this password grants full control over the database. Similarly, the Linux AppImage versions 6.3.0 through 6.3.5 create per-user data folders that are readable by other local users, exposing sensitive data.

Local authenticated users can read sensitive data including all stored emails, logs, password hashes, and configuration files containing database credentials. This can lead to unauthorized disclosure of confidential information and potential full control over the mail server's database if an external database is used. The vulnerability affects confidentiality, integrity, and availability as indicated by the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local user access to the installation directories and data folders by manually adjusting permissions to prevent unauthorized read access. Consider running the service under a dedicated user account with minimal privileges and isolating the server environment to limit local user access.