Threats Tagged 'cve-2026-107587'

hMailServer versions 6.3.2 through 6.3.5 have an improper certificate validation vulnerability in their webmail component. This flaw allows a remote unauthenticated attacker to cause S/MIME-encrypted mail, later sent by the account holder, to be encrypted to the attacker's key. The webmail stores the signer's certificate for encrypting replies without verifying the certificate chain's trust, associating it with the first email address in the certificate rather than the message's From address. Consequently, encrypted mail sent to that address is encrypted to all certificates held for it, enabling an attacker with the private key to read such messages.