{"id":"CVE-2026-104658","published":"2026-10-08T11:16:43.870","lastModified":"2026-10-08T21:02:43.860","description":"The Linux live-update apply helper (hmailserver-update) of Progressive Robot hMailServer 6.3.4 and 6.3.5 runs as root on a request file written by the unprivileged hmailserver service account, and took from that request the program used to verify an AppImage update's signature and the systemd unit to stop before reading the service account's files. An attacker who already runs code as the hmailserver service account, for example through another flaw in the mail server, can therefore have arbitrary code executed as root, on any Linux installation where the live update's path unit is active - the default for the project's .deb and .rpm packages - and on AppImage installations run under that unit.","cvssScore":7.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-807"],"vendors":[],"products":[],"references":[{"url":"https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.6","tags":[]},{"url":"https://gitlab.com/hmailserver/hmailserver/-/work_items/58","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A privilege escalation flaw exists in hMailServer's live-update helper that allows an attacker with the hmailserver service account to execute arbitrary code as root, affecting versions 6.3.4 and 6.3.5.","exploitability":"Exploitation requires an attacker to already have code execution as the unprivileged hmailserver service account, which is a moderate precondition but achievable through other vulnerabilities in the mail server.","blast_radius":"The flaw impacts all Linux installations where the live update systemd unit is active, which is the default for .deb and .rpm packages, making it widely exploitable across deployed systems.","remediation":"Upgrade to hMailServer version 6.3.6 or later to remediate this privilege escalation vulnerability.","detection":"Monitor for execution of the hmailserver-update binary with root privileges, particularly when invoked from paths controlled by the hmailserver service account, and check for suspicious systemd unit modifications or service stoppages.","tags":["privilege-escalation","linux","systemd","rce"],"model":"garnet-coder","analyzedAt":"2026-10-16T09:22:37.388Z"}}