CVE-2026-7807 is a path traversal vulnerability in SmarterTools SmarterMail builds before 9560. It exists in the /api/v1/report/summary/{type} API endpoint, permitting authenticated users to include and read arbitrary JSON files from the server filesystem. The vulnerability is compounded by weak encryption algorithms and hardcoded keys used to protect stored credentials and 2FA secrets, enabling attackers to decrypt and access sensitive user authentication data.

Successful exploitation allows an authenticated attacker to read arbitrary JSON files on the server, potentially exposing stored passwords and two-factor authentication secrets for all users. This compromises user account security and could lead to unauthorized access to mail accounts and sensitive information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is currently available. Until a patch is released, restrict access to the vulnerable API endpoint to trusted users only and monitor for suspicious activity. Avoid using weak encryption algorithms and hardcoded keys in credential storage.