EUVD-2026-94833
GHSA-p223-vjjq-q36p
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitation needs an interactive local/RDP session (AV:L, PR:L for an authenticated OS user) with no complexity or user interaction, and arbitrary read/write as SYSTEM yields full C/I/A.
Primary rating from Vendor (GitLab).
CVSS VectorVendor: GitLab
Lifecycle Timeline
5DescriptionCVE.org
Missing authorization on COM objects in Progressive Robot hMailServer 6.0.0 through 6.3.5 (Windows only) lets a local interactive user with no hMailServer credential read and write arbitrary files as the service account and queue mail as any sender. The service registers its COM classes with no DCOM access or launch permission and calls CoInitializeSecurity with no security descriptor, so any user logged on at the console or over Remote Desktop can activate the classes in the running service; a hMailServer.Message, its Attachments and Attachment, and a hMailServer.FetchAccount created this way carry a credential that never authenticated. Attachments.Add(path) and Attachment.SaveAs(path) performed no authorization check, and Message.Save/Copy and FetchAccount.AccountID/Save performed none either up to 6.3.3 and from 6.3.4 treated a holder with no credential as the server's own event-script host. Because the service does not impersonate the COM caller, Attachments.Add reads any file the service account can read and returns it, Attachment.SaveAs writes attacker-chosen bytes to any path it can write (on a LocalSystem installation, code execution as SYSTEM), Message.Save queues outbound mail from any address past the SMTP checks, and FetchAccount attaches a mail-fetch job to any mailbox. The objects an Application handed out behave the same once a later Authenticate on that Application fails.
Articles & Coverage 2
AnalysisAI
Local privilege escalation in hMailServer 6.0.0 through 6.3.5 on Windows allows an authenticated local user-one with an interactive logon but no hMailServer credentials-to abuse COM objects to read and write arbitrary files as the service account and send mail as any sender. The service registers its COM classes without DCOM launch or access permissions and calls CoInitializeSecurity with a null security descriptor, so any user logged on at the console or over Remote Desktop can activate hMailServer.Message, Attachments, and hMailServer.FetchAccount objects. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an interactive logon session on the Windows host running hMailServer 6.0.0-6.3.5 - either at the physical console or over Remote Desktop - but requires NO hMailServer mailbox or admin credential, because the service registers its COM classes with no DCOM launch/access permissions and calls CoInitializeSecurity with a null security descriptor. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a credible, real-world-relevant local privilege/authorization flaw rather than a CVSS-inflated non-issue, but it is NOT an internet-facing emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to hMailServer 6.3.6, the vendor-released patch (see https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.6). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Windows hosts running hMailServer versions 6.0.0 through 6.3.5, confirm whether the service runs as LocalSystem, and where it does, reconfigure the service to run under a dedicated low-privilege account with no interactive logon rights and file access limited strictly to its mail directories - this breaks the path from file write to SYSTEM code execution. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today