CVE-2026-126625

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-126625", "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "state": "PUBLISHED", "assignerShortName": "GitLab", "dateReserved": "2026-11-11T08:31:07.141Z", "datePublished": "2026-11-11T08:31:57.131Z", "dateUpdated": "2026-11-11T08:31:57.131Z"}, "containers": {"cna": {"title": "Incorrect Default Permissions in hMailServer", "descriptions": [{"lang": "en", "value": "Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.3.7 allow a local authenticated user to run code as the administrator who installs the product, when it is installed into a new program folder in a location whose permissions let every user write, such as the root of a drive. 6.3.7 fixed CVE-2026-107571 by giving the program folder, Bin and ControlPanel permissions that only administrators may change, but its setup lets Inno Setup make a new program folder first, with the permissions the folder above hands down, and replaces them only afterwards, tens of milliseconds later (33 to 139 milliseconds in the project's test runs). In that time any local account may make files and folders in the new folder, which keep that account as their owner, among them the Bin folder that setup then copies the programs into. Setup runs programs from Bin with the administrator's elevated rights, registering the service among them, before its hardening at the end of setup takes such a folder back, and those programs load a library placed in Bin in place of the system's. The default installation under Program Files, whose folders give ordinary users read and execute only, is not affected."}], "affected": [{"vendor": "Progressive Robot Ltd", "product": "hMailServer", "repo": "https://gitlab.com/hmailserver/hmailserver", "versions": [{"version": "6.3.7", "status": "affected"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-276: Incorrect Default Permissions", "cweId": "CWE-276", "type": "CWE"}]}], "references": [{"url": "https://gitlab.com/hmailserver/hmailserver/-/work_items/78"}, {"url": "https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2026-107571"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H", "attackVector": "LOCAL", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 6.7, "baseSeverity": "MEDIUM"}}], "solutions": [{"lang": "en", "value": "Upgrade to hMailServer 6.3.8, whose setup makes a new program folder, every folder above it that is not there, and Bin and ControlPanel in it, with permissions of their own from the moment each exists - SYSTEM and the Administrators full control, Users read and execute, nothing inherited, the Administrators the owner - before Inno Setup makes a folder or copies a file, each made by its name relative to the folder above it, which setup holds open. Until then, install hMailServer under Program Files, or into a new folder inside a folder that only administrators may change. To install elsewhere, first make the program folder from an elevated Command Prompt and give it a protected set of permissions - icacls \"<program folder>\" /inheritance:r /grant:r *S-1-5-18:(OI)(CI)F *S-1-5-32-544:(OI)(CI)F *S-1-5-32-545:(OI)(CI)RX, then icacls \"<program folder>\" /setowner *S-1-5-32-544 - check with dir /q /a \"<program folder>\" that nothing has been made in it, and restart Windows before running setup, so that nothing opened in it before its permissions were set stays open."}], "credits": [{"lang": "en", "value": "Found by the hMailServer project (Progressive Robot Ltd)", "type": "finder"}], "providerMetadata": {"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab", "dateUpdated": "2026-11-11T08:31:57.131Z"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "hMailServer", "repo": "https://gitlab.com/hmailserver/hmailserver", "vendor": "Progressive Robot Ltd", "versions": [{"status": "affected", "version": "6.3.7"}]}], "source": "cve@gitlab.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.3.7 allow a local authenticated user to run code as the administrator who installs the product, when it is installed into a new program folder in a location whose permissions let every user write, such as the root of a drive. 6.3.7 fixed CVE-2026-107571 by giving the program folder, Bin and ControlPanel permissions that only administrators may change, but its setup lets Inno Setup make a new program folder first, with the permissions the folder above hands down, and replaces them only afterwards, tens of milliseconds later (33 to 139 milliseconds in the project's test runs). In that time any local account may make files and folders in the new folder, which keep that account as their owner, among them the Bin folder that setup then copies the programs into. Setup runs programs from Bin with the administrator's elevated rights, registering the service among them, before its hardening at the end of setup takes such a folder back, and those programs load a library placed in Bin in place of the system's. The default installation under Program Files, whose folders give ordinary users read and execute only, is not affected."}], "id": "CVE-2026-126625", "lastModified": "2026-11-12T19:05:35.013", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 0.8, "impactScore": 5.9, "source": "cve@gitlab.com", "type": "Secondary"}]}, "published": "2026-11-11T09:17:14.833", "references": [{"source": "cve@gitlab.com", "url": "https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8"}, {"source": "cve@gitlab.com", "url": "https://gitlab.com/hmailserver/hmailserver/-/work_items/78"}, {"source": "cve@gitlab.com", "url": "https://www.cve.org/CVERecord?id=CVE-2026-107571"}], "sourceIdentifier": "cve@gitlab.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-276"}], "source": "cve@gitlab.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.3.7"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "hMailServer", "source": "cna", "vendor": "Progressive Robot Ltd"}, "product": "hmailserver", "vendor": "progressive_robot"}], "created": "2026-11-12T01:15:09.712468+00:00", "updated": "2026-11-13T10:15:19.033019+00:00", "vendors": ["progressive_robot", "progressive_robot$PRODUCT$hmailserver"]}