CVE-2026-104660

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-104660", "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "state": "PUBLISHED", "assignerShortName": "GitLab", "dateReserved": "2026-10-02T07:39:04.118Z", "datePublished": "2026-10-08T10:52:50.630Z", "dateUpdated": "2026-10-08T14:25:20.499Z"}, "containers": {"cna": {"title": "Missing Authorization in hMailServer", "descriptions": [{"lang": "en", "value": "Missing authorization on COM objects in Progressive Robot hMailServer 6.0.0 through 6.3.5 (Windows only) lets a local interactive user with no hMailServer credential read and write arbitrary files as the service account and queue mail as any sender. The service registers its COM classes with no DCOM access or launch permission and calls CoInitializeSecurity with no security descriptor, so any user logged on at the console or over Remote Desktop can activate the classes in the running service; a hMailServer.Message, its Attachments and Attachment, and a hMailServer.FetchAccount created this way carry a credential that never authenticated. Attachments.Add(path) and Attachment.SaveAs(path) performed no authorization check, and Message.Save/Copy and FetchAccount.AccountID/Save performed none either up to 6.3.3 and from 6.3.4 treated a holder with no credential as the server's own event-script host. Because the service does not impersonate the COM caller, Attachments.Add reads any file the service account can read and returns it, Attachment.SaveAs writes attacker-chosen bytes to any path it can write (on a LocalSystem installation, code execution as SYSTEM), Message.Save queues outbound mail from any address past the SMTP checks, and FetchAccount attaches a mail-fetch job to any mailbox. The objects an Application handed out behave the same once a later Authenticate on that Application fails."}], "affected": [{"vendor": "Progressive Robot Ltd", "product": "hMailServer", "repo": "https://gitlab.com/hmailserver/hmailserver", "versions": [{"version": "6.0.0", "status": "affected", "lessThan": "6.3.6", "versionType": "semver"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862: Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "references": [{"url": "https://gitlab.com/hmailserver/hmailserver/-/work_items/59"}, {"url": "https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.6"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH"}}], "solutions": [{"lang": "en", "value": "Upgrade to hMailServer 6.3.6, whose COM API refuses a message or fetch account that carries no credential outside the server's own event scripts, serves and writes a file on the server's disk through a message to the server administrator alone, and adds Application.CreateMessage() so a signed-in program composes mail that carries its credential. Until then: Do not allow untrusted users to log on interactively (console or Remote Desktop) to the server host. There is no configuration switch that closes this before 6.3.6; restricting the DCOM AppID's launch/access permission to exclude INTERACTIVE would also close it."}], "credits": [{"lang": "en", "value": "Found in the hMailServer project's own security review (Progressive Robot Ltd)", "type": "finder"}], "providerMetadata": {"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab", "dateUpdated": "2026-10-08T10:52:50.630Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-08T14:25:10.301436Z", "id": "CVE-2026-104660", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-08T14:25:20.499Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-104660", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-08T14:25:10.301436Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-08T14:25:16.708Z"}}], "cna": {"title": "Missing Authorization in hMailServer", "credits": [{"lang": "en", "type": "finder", "value": "Found in the hMailServer project's own security review (Progressive Robot Ltd)"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://gitlab.com/hmailserver/hmailserver", "vendor": "Progressive Robot Ltd", "product": "hMailServer", "versions": [{"status": "affected", "version": "6.0.0", "lessThan": "6.3.6", "versionType": "semver"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade to hMailServer 6.3.6, whose COM API refuses a message or fetch account that carries no credential outside the server's own event scripts, serves and writes a file on the server's disk through a message to the server administrator alone, and adds Application.CreateMessage() so a signed-in program composes mail that carries its credential. Until then: Do not allow untrusted users to log on interactively (console or Remote Desktop) to the server host. There is no configuration switch that closes this before 6.3.6; restricting the DCOM AppID's launch/access permission to exclude INTERACTIVE would also close it."}], "references": [{"url": "https://gitlab.com/hmailserver/hmailserver/-/work_items/59"}, {"url": "https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.6"}], "descriptions": [{"lang": "en", "value": "Missing authorization on COM objects in Progressive Robot hMailServer 6.0.0 through 6.3.5 (Windows only) lets a local interactive user with no hMailServer credential read and write arbitrary files as the service account and queue mail as any sender. The service registers its COM classes with no DCOM access or launch permission and calls CoInitializeSecurity with no security descriptor, so any user logged on at the console or over Remote Desktop can activate the classes in the running service; a hMailServer.Message, its Attachments and Attachment, and a hMailServer.FetchAccount created this way carry a credential that never authenticated. Attachments.Add(path) and Attachment.SaveAs(path) performed no authorization check, and Message.Save/Copy and FetchAccount.AccountID/Save performed none either up to 6.3.3 and from 6.3.4 treated a holder with no credential as the server's own event-script host. Because the service does not impersonate the COM caller, Attachments.Add reads any file the service account can read and returns it, Attachment.SaveAs writes attacker-chosen bytes to any path it can write (on a LocalSystem installation, code execution as SYSTEM), Message.Save queues outbound mail from any address past the SMTP checks, and FetchAccount attaches a mail-fetch job to any mailbox. The objects an Application handed out behave the same once a later Authenticate on that Application fails."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization"}]}], "providerMetadata": {"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab", "dateUpdated": "2026-10-08T10:52:50.630Z"}}}, "cveMetadata": {"cveId": "CVE-2026-104660", "state": "PUBLISHED", "dateUpdated": "2026-10-08T14:25:20.499Z", "dateReserved": "2026-10-02T07:39:04.118Z", "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "datePublished": "2026-10-08T10:52:50.630Z", "assignerShortName": "GitLab"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "hMailServer", "repo": "https://gitlab.com/hmailserver/hmailserver", "vendor": "Progressive Robot Ltd", "versions": [{"lessThan": "6.3.6", "status": "affected", "version": "6.0.0", "versionType": "semver"}]}], "source": "cve@gitlab.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Missing authorization on COM objects in Progressive Robot hMailServer 6.0.0 through 6.3.5 (Windows only) lets a local interactive user with no hMailServer credential read and write arbitrary files as the service account and queue mail as any sender. The service registers its COM classes with no DCOM access or launch permission and calls CoInitializeSecurity with no security descriptor, so any user logged on at the console or over Remote Desktop can activate the classes in the running service; a hMailServer.Message, its Attachments and Attachment, and a hMailServer.FetchAccount created this way carry a credential that never authenticated. Attachments.Add(path) and Attachment.SaveAs(path) performed no authorization check, and Message.Save/Copy and FetchAccount.AccountID/Save performed none either up to 6.3.3 and from 6.3.4 treated a holder with no credential as the server's own event-script host. Because the service does not impersonate the COM caller, Attachments.Add reads any file the service account can read and returns it, Attachment.SaveAs writes attacker-chosen bytes to any path it can write (on a LocalSystem installation, code execution as SYSTEM), Message.Save queues outbound mail from any address past the SMTP checks, and FetchAccount attaches a mail-fetch job to any mailbox. The objects an Application handed out behave the same once a later Authenticate on that Application fails."}], "id": "CVE-2026-104660", "lastModified": "2026-10-08T21:02:43.860", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "cve@gitlab.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-104660", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-08T14:25:10.301436Z", "version": "2.0.3"}}]}, "published": "2026-10-08T11:16:44.160", "references": [{"source": "cve@gitlab.com", "url": "https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.6"}, {"source": "cve@gitlab.com", "url": "https://gitlab.com/hmailserver/hmailserver/-/work_items/59"}], "sourceIdentifier": "cve@gitlab.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "cve@gitlab.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.0.0,6.3.6)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "hMailServer", "source": "cna", "vendor": "Progressive Robot Ltd"}, "product": "hmailserver", "vendor": "progressive_robot"}], "created": "2026-10-08T12:30:04.208154+00:00", "updated": "2026-10-08T12:45:18.252020+00:00", "vendors": ["progressive_robot", "progressive_robot$PRODUCT$hmailserver"]}