CVE-2026-107587
Received Received - Intake

Improper Certificate Validation in hMailServer Webmail

Publication date: 2026-10-08

Last updated on: 2026-10-08

Assigner: GitLab Inc.

Description
Improper certificate validation in the webmail of Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote unauthenticated attacker to have S/MIME-encrypted mail that the account later sends to another correspondent also encrypted to the attacker's key. When its recipient opened a signed message, the webmail kept the signer's certificate for encrypting replies whether or not the server found its chain trusted, under the first e-mail address the certificate listed rather than the message's From address, and beside any certificate already held for that address. Encrypted mail later sent from the webmail to that address was encrypted to every certificate held for it, so a holder of the kept certificate's key who obtains a copy of such a message can read it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-08
Last Modified
2026-10-08
Generated
2026-10-08
AI Q&A
2026-10-08
EPSS Evaluated
N/A
NVD
CVE-2026-107587
EUVD
EUVD-2026-94865

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Progressive Robot Ltd hMailServer 6.3.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-295 The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves improper certificate validation in hMailServer's webmail S/MIME feature. An attacker sends a signed S/MIME message to a victim, causing the server to store the attacker's certificate under the victim's email address. Later, if the victim sends an encrypted reply via webmail, the message is also encrypted to the attacker's key, allowing decryption of the message.

Detection Guidance

Check hMailServer versions 6.3.2 through 6.3.5 for the webmail S/MIME feature. Review stored certificates in webmail settings for unexpected entries under user email addresses. Monitor for encrypted replies being sent to untrusted addresses.

Impact Analysis

If you use hMailServer versions 6.3.2 through 6.3.5 with the webmail S/MIME feature, an attacker could read encrypted emails you send after receiving a signed message from them. The attacker does not need an account or to spoof your domain, as the message can pass email authentication checks.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive encrypted emails, potentially violating data protection requirements under GDPR, HIPAA, or other regulations. Organizations using affected hMailServer versions may face compliance risks due to potential data breaches.

Mitigation Strategies

Upgrade hMailServer to version 6.3.6 or later. Review and remove untrusted certificates stored in webmail settings. Ensure S/MIME encryption is only enabled for trusted certificates and verify recipient addresses before sending encrypted replies.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-107587. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart