{"id":"CVE-2026-104660","published":"2026-10-08T11:16:44.160","lastModified":"2026-10-08T21:02:43.860","description":"Missing authorization on COM objects in Progressive Robot hMailServer 6.0.0 through 6.3.5 (Windows only) lets a local interactive user with no hMailServer credential read and write arbitrary files as the service account and queue mail as any sender. The service registers its COM classes with no DCOM access or launch permission and calls CoInitializeSecurity with no security descriptor, so any user logged on at the console or over Remote Desktop can activate the classes in the running service; a hMailServer.Message, its Attachments and Attachment, and a hMailServer.FetchAccount created this way carry a credential that never authenticated. Attachments.Add(path) and Attachment.SaveAs(path) performed no authorization check, and Message.Save/Copy and FetchAccount.AccountID/Save performed none either up to 6.3.3 and from 6.3.4 treated a holder with no credential as the server's own event-script host. Because the service does not impersonate the COM caller, Attachments.Add reads any file the service account can read and returns it, Attachment.SaveAs writes attacker-chosen bytes to any path it can write (on a LocalSystem installation, code execution as SYSTEM), Message.Save queues outbound mail from any address past the SMTP checks, and FetchAccount attaches a mail-fetch job to any mailbox. The objects an Application handed out behave the same once a later Authenticate on that Application fails.","cvssScore":7.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.6","tags":[]},{"url":"https://gitlab.com/hmailserver/hmailserver/-/work_items/59","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A local user can bypass authorization on COM objects in hMailServer to read and write arbitrary files as the service account, queue mail as any sender, and manipulate fetch accounts without authentication. This allows privilege escalation and data compromise.","exploitability":"Exploitation is straightforward for any local interactive user with console or RDP access, requiring no special credentials or conditions beyond basic system access.","blast_radius":"The impact could be severe, allowing arbitrary file read/write as the service account (potentially SYSTEM) and enabling spoofed email sending from any address, affecting mail server integrity and confidentiality.","remediation":"Upgrade to hMailServer 6.3.4 or later to fix the authorization bypass in COM objects.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["com","authorization","privilege-escalation"],"model":"garnet-coder","analyzedAt":"2026-10-16T09:22:31.225Z"}}