CVE-2026-107571
Received Received - Intake

Incorrect Default Permissions in hMailServer Windows Installer Allow Privilege Escalation

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: GitLab Inc.

Description
Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.6 allow a local authenticated user to run code as the mail server's high-privileged accounts when the product is installed in a folder whose permissions are inherited from a writable parent, such as the root of a drive. The installer places the server's programs in the Bin folder of the program folder and gives neither the program folder nor Bin any permissions of their own, so they inherit the parent's. Under the default location, Program Files, ordinary users receive only read and execute and the configuration is not affected; but the installer accepts any path without warning, and a program folder at the root of an NTFS volume inherits write access for a broad group - Authenticated Users (Modify) on a Windows client, Users (create files and folders) on Windows Server. A local user without administrator rights can then alter or replace the service program, which runs as LocalSystem or as the service's virtual account, or the programs an administrator runs elevated from Bin during setup and maintenance, or place a library in Bin that those programs load in place of the system copy, gaining code execution with those privileges. The default Program Files installation is not affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-107571
EUVD
EUVD-2026-104410

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Progressive Robot Ltd hMailServer 6.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-276 During installation, installed file permissions are set to allow anyone to modify those files.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-107571 is a privilege escalation vulnerability in hMailServer versions 6.0.0 through 6.3.6 on Windows. The installer fails to set proper folder permissions, allowing local authenticated users to modify or replace executable files or libraries in the program's Bin folder. This can lead to arbitrary code execution with SYSTEM privileges or the service's virtual account.

Detection Guidance

Check if hMailServer is installed in a folder with overly permissive inherited permissions, such as the root of a drive (e.g., C:\hMailServer). Use icacls to inspect folder permissions: icacls "C:\hMailServer" and icacls "C:\hMailServer\Bin". If Authenticated Users or Users groups have Modify or Full Control rights, the system is vulnerable.

Impact Analysis

An attacker with local access to your system could exploit this to gain full control over your machine. They could replace hMailServer binaries or inject malicious libraries, allowing them to execute commands as the SYSTEM account or the mail server's virtual account. This could lead to complete system compromise, data theft, or further network infiltration.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security rules. A successful exploit may result in data breaches, unauthorized disclosure of personal or health information, and failure to maintain adequate security controls required by these regulations.

Mitigation Strategies

1. Reinstall hMailServer into a secure directory like %ProgramFiles%. 2. Manually restrict folder permissions using icacls: icacls "C:\hMailServer" /inheritance:r /remove:g "Authenticated Users" /remove:g "Users" /grant:r "SYSTEM:(F)" /grant:r "Administrators:(F)" /grant:r "TrustedInstaller:(F)". 3. Upgrade to version 6.3.7 or later and use the /ProtectFolders command during installation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-107571. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart