EUVD-2026-94855
GHSA-6v8h-9479-g4ch
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Any signed-in local user (PR:L) can read sensitive files locally (AV:L) with no interaction or special conditions beyond default install (AC:L); recovered DB credentials yield full control, supporting C/I/A:H.
Primary rating from Vendor (GitLab).
CVSS VectorVendor: GitLab
Lifecycle Timeline
5DescriptionCVE.org
Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a local authenticated user to read the mail server's data. The installer created the data, log, temp, database and event folders and the hMailServer.INI configuration file with the permissions inherited from the installation folder, by default under Program Files, which give the local Users group read access. Any user who can sign in to the computer could read every stored message, the logs, the built-in database with the accounts' password hashes whenever the service is stopped, and the configuration file, including the database password, which is sealed only with the machine's DPAPI key and can be unsealed by any local account; with an external database that password gives full control of it. The Linux AppImage of 6.3.0 through 6.3.5 likewise created its per-user data folders readable by other local users.
Articles & Coverage 2
AnalysisAI
Incorrect default permissions in the Windows installer for Progressive Robot hMailServer 6.0.0 through 6.3.5 let any local authenticated user read the mail server's stored messages, logs, temporary files, and built-in database, because the data, log, temp, database and event folders and the hMailServer.INI file inherit the local Users group's read access from the default installation path under Program Files. The readable INI exposes the database password, which is protected only by the machine's DPAPI key and can therefore be unsealed by any local account - handing full control of an external database - while the built-in database's account password hashes become readable whenever the hMailServer service is stopped; the Linux AppImage 6.3.0 through 6.3.5 has a parallel weakness in per-user data folder permissions. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that hMailServer 6.0.0-6.3.5 was installed via the Windows installer using the default installation path under Program Files, so the data, log, temp, database, and event folders and hMailServer.INI inherit the local Users group's read permission; it also requires an untrusted local account able to sign in to the host. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a credible but context-limited local information-disclosure/privilege-escalation issue, not an internet-facing emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to hMailServer 6.3.6 (https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.6), which addresses the insecure default permissions described in the vendor work item (https://gitlab.com/hmailserver/hmailserver/-/work_items/77). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all hMailServer deployments to identify versions 6.0.0 through 6.3.5 on Windows and 6.3.0 through 6.3.5 on Linux AppImage, restrict local interactive sign-in to trusted administrators, and inspect the data, log, temp, database, and event folders plus hMailServer.INI to remove local Users group read access; within 7 days, apply vendor-released patch 6.3.6 (or, if the metadata patch status is accurate and 6.3.6 is not available, isolate affected hosts, move data directories to a non-default location with restrictive ACLs, rotate the database password and any DPAPI-protected secrets, and stop the hMailServer service when not in use to protect the built-in database); within 30 days, verify remediation by rechecking folder permissions and INI exposure, rotate all potentially exposed credentials, and monitor for unauthorized access to mail server data directories.
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Same weakness CWE-276 – Incorrect Default Permissions
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today