Threat database

SmarterMail before build 9777 has a privilege escalation vulnerability due to insufficient session expiration. JWT access and refresh tokens embed a role claim that is not revalidated upon token refresh. This allows attackers to replay stale refresh tokens issued before an administrator's role demotion to regain higher privileges until token expiry.

SmarterMail versions before build 9777 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows remote attackers to inject executable scripts by embedding payloads inside a <style> element nested within MathML foreign content, which bypasses the custom HTML sanitizer. Exploitation occurs when a crafted calendar (iCal) message with an <img> tag containing an onerror event is opened in the recipient's webmail session, leading to script execution and potential data exfiltration despite the Content-Security-Policy in place.

SmarterMail versions before build 9777 contain a remote code execution vulnerability that allows attackers with SysAdmin-scoped access tokens to bypass script directory containment controls. By provisioning a new mail domain with a crafted FileStore root path, attackers can upload malicious scripts that execute with SYSTEM-level privileges, resulting in a reverse shell. This vulnerability is identified as CVE-2026-104082 and has a high severity rating.

SmarterTools SmarterMail builds prior to 9560 contain a local file inclusion vulnerability in the /api/v1/report/summary/{type} API endpoint that allows authenticated users to read arbitrary .json files on the system. Attackers can exploit this vulnerability combined with weak encryption algorithms and hardcoded keys to decrypt and access stored passwords and 2FA secrets for all users.

SmarterTools SmarterMail builds prior to 9610 contain a cryptographic weakness in the file and email sharing endpoints that use DES-CBC encryption with keys and initialization vectors derived from System.Random seeded with insufficient entropy, reducing the seed space to approximately 19,000 possible values. An unauthenticated attacker can use the attachment download endpoint as an oracle to determine the seed in use and derive encryption keys and initialization vectors to forge sharing tokens for arbitrary emails, attachments, or file storage contents without prior access to the targeted content.

SmarterTools SmarterMail before 9526 allows XSS via MAPI requests.

EPSS 0.4%VulnerabilitySmarterTools#cwe-79United States+9

SmarterTools SmarterMail versions prior to build 9518 contain an unauthenticated path coercion vulnerability in the background-of-the-day preview endpoint. The application base64-decodes attacker-supplied input and uses it as a filesystem path without validation. On Windows systems, this allows UNC paths to be resolved, causing the SmarterMail service to initiate outbound SMB authentication attempts to attacker-controlled hosts. This can be abused for credential coercion, NTLM relay attacks, and unauthorized network authentication.

EPSS 0.3%VulnerabilitySmarterTools#cwe-706United States+9

SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method. The attacker could point the SmarterMail to the malicious HTTP server, which serves the malicious OS command. This command will be executed by the vulnerable application.

SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. An unauthenticated attacker can supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance. NOTE: SmarterMail system administrator privileges grant the ability to execute operating system commands via built-in management functionality, effectively providing administrative (SYSTEM or root) access on the underlying host.

KEVEPSS 96%VulnerabilitySmarterTools#cwe-288United States+9

Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.

KEVEPSS 85%VulnerabilitySmarterToolsUnited StatesCanada+8