CVSS 3.1
7.3 highCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:HCVE-2026-126622 Incorrect Default Permissions in hMailServer
High (7.3) in progressive robot ltd hmailserver. EPSS 0.1% estimated probability of exploitation activity in the next 30 days.
On this page
Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.3.7 allow a local authenticated user to run code as the administrator who runs setup, when the server is installed into a program folder that is already there and that accounts other than the administrators could write, such as a folder made beforehand at the root of a drive, or when such an installation is upgraded or repaired. 6.3.7 fixed CVE-2026-107571 by giving the program folder, Bin and ControlPanel permissions that only administrators may change, but for a folder that is already there it does so only at the end of setup: setup first copies the programs into Bin, which every user may still write, and runs programs from Bin with the administrator's elevated rights, registering the service among them, before that hardening, so that a library another account places in Bin meanwhile is loaded in place of the system's. A handle an account opened on such a folder while it could write it keeps that access after the hardening. The default installation under Program Files, whose folders give ordinary users read and execute only, is not affected.
Severity
- EPSS
- 0.1% estimated probability of exploitation activity in the next 30 days; 2nd percentile. Scored 2026-11-13. A forecast for this CVE across the internet, not for your own systems.
- CWE
- CWE-276 Incorrect Default Permissions
- OWASP Top 10
- A01:2025 Broken Access Control
- Published
- Modified
- Assigned by
- GitLab (CNA)
- NVD analysis
- Deferred: the NVD does not plan to analyze it
- Record from
- the NVD, synced
Ask an AI about this CVE
Show the prompt
Explain CVE-2026-126622 for an engineer deciding whether to act. Use https://cve.bz/api/public/cves/CVE-2026-126622?via=ask-ai-copy and https://cve.bz/cve/CVE-2026-126622?via=ask-ai-copy as the source of truth: what is affected and which versions fix it, whether it is in CISA KEV, public exploits, and its EPSS (an internet-wide 30-day estimate of exploitation activity, not a forecast for my systems). If they give no fixed versions, use the CVE record https://cveawg.mitre.org/api/cve/CVE-2026-126622 or the vendor advisory, not third-party mirrors. Tell me how to check whether I am affected and how to verify a fix. Cite the sources and say where they are uncertain.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this CVE's id and public links.
Badge for a README or a site
An image that stays current: it is drawn from the data each time it is fetched (a host that proxies images, as GitHub does, may show its copy for a while). Markdown:
[](https://cve.bz/cve/CVE-2026-126622)
HTML:
<a href="https://cve.bz/cve/CVE-2026-126622"><img src="https://cve.bz/cve/badge/CVE-2026-126622.svg" alt="CVE-2026-126622"></a>
Affected
- progressive robot ltd:hmailserver
Versions
From the CNA's record in the CVE List.
| Product | Affected |
|---|---|
| Progressive Robot Ltd hMailServer | 6.3.7 |
Attack patterns (CAPEC)
- CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs Likelihood: High · Severity: High
- CAPEC-81 Web Server Logs Tampering Likelihood: Medium · Severity: High
- CAPEC-127 Directory Indexing Likelihood: High · Severity: Medium
The attack patterns MITRE's CAPEC relates to this record's weaknesses, as MITRE names them. Credits.
History
- The NVD deferred its analysis
Changes since this site first stored the record. The same for every record: /api/public/changes.