Threats tagged 'ghsa-5vrf-r3xw-59r9'

CVE-2026-126624 is a vulnerability in the Windows installer of Progressive Robot hMailServer 6.3.7 that allows a local authenticated user to execute code with elevated privileges. The issue arises when the installer installs or upgrades into a program folder where non-administrative users already have write permissions. Although version 6.3.7 hardened folder permissions for the program folder, Bin, and ControlPanel to restrict changes to administrators only, it does not change ownership or permissions of existing files or folders that other accounts control. This allows an attacker to place or maintain malicious binaries or scripts that run with elevated rights during installation or service execution. The default installation under Program Files is not affected.