# CVE-2026-126622: Incorrect Default Permissions in hMailServer

Status: published. Published: 2026-11-11. Updated: 2026-11-11.

Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.3.7 allow a local authenticated user to run code as the administrator who runs setup, when the server is installed into a program folder that is already there and that accounts other than the administrators could write, such as a folder made beforehand at the root of a drive, or when such an installation is upgraded or repaired. 6.3.7 fixed CVE-2026-107571 by giving the program folder, Bin and ControlPanel permissions that only administrators may change, but for a folder that is already there it does so only at the end of setup: setup first copies the programs into Bin, which every user may still write, and runs programs from Bin with the administrator's elevated rights, registering the service among them, before that hardening, so that a library another account places in Bin meanwhile is loaded in place of the system's. A handle an account opened on such a folder while it could write it keeps that access after the hardening. The default installation under Program Files, whose folders give ordinary users read and execute only, is not affected.

## Remediation

- fix: Upgrade to hMailServer 6.3.8, whose setup hardens a program folder, Bin and ControlPanel that are already there before it stops the service, copies a file or runs a program of the installation, reading each through a handle it holds; refuses to install into one it cannot harden, or one another account owns that is not the earlier installation's; makes an empty Bin or ControlPanel again rather than use it; and, where another account could change one of the program's folders before this installation, hardens it and refuses to install until Windows has restarted, which closes any handle opened while it could. Until then, install hMailServer under Program Files, or into a new folder inside one that only administrators may change. Before running setup into or over a program folder in a location other accounts can write, follow from an elevated Command Prompt the steps in the hMailServer documentation, ServiceAccount.md, "Before upgrading an installation at a drive's root", which make the program folder, Bin and ControlPanel the Administrators' with a protected set of permissions, then restart Windows before running setup. Where accounts that are not administrators could change the folder before, reinstall into a new folder as that page's "Reinstalling into a new folder" says. (source: CNA: GitLab)

## Affected products and versions

- Progressive Robot Ltd / hMailServer: 6.3.7 (affected). Source: CNA: GitLab

## Severity and prioritization

- CVSS 3.1: 7.3 (high); CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H; source: CNA: GitLab

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-276

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://gitlab.com/hmailserver/hmailserver/-/work_items/78 (CNA: GitLab)

- https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8 (CNA: GitLab)

- https://www.cve.org/CVERecord?id=CVE-2026-107571 (CNA: GitLab)

## Provenance

- CNA: GitLab: https://www.cve.org/CVERecord?id=CVE-2026-126622; retrieved 2026-11-11; source updated 2026-11-11

Revision: dd37fd4bb2770541707b705265589e9f8f53677666d9a8ea8c7150ee617da8cb

Canonical: https://y2.dev/cve/CVE-2026-126622

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.