CVE-2026-107587

Improper certificate validation in the webmail of Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote unauthenticated attacker to have S/MIME-encrypted mail that the account later sends to another correspondent also encrypted to the attacker's key. When its recipient opened a signed message, the webmail kept the signer's certificate for encrypting replies whether or not the server found its chain trusted, under the first e-mail address the certificate listed rather than the message's From address, and beside any certificate already held for that address. Encrypted mail later sent from the webmail to that address was encrypted to every certificate held for it, so a holder of the kept certificate's key who obtains a copy of such a message can read it.

CVSS v3 5.9 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.6
https://gitlab.com/hmailserver/hmailserver/-/work_items/66

Configurations

No configuration.

History

08 Oct 2026, 12:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-08 12:17

Updated : 2026-10-08 21:02

NVD link : CVE-2026-107587

Mitre link : CVE-2026-107587

CVE.ORG link : CVE-2026-107587

JSON object : View

Products Affected

No product.

CWE

CWE-295

Improper Certificate Validation

{"id": "CVE-2026-107587", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-107587", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-08T14:13:29.336107Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@gitlab.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 1.6}]}, "affected": [{"source": "cve@gitlab.com", "affectedData": [{"repo": "https://gitlab.com/hmailserver/hmailserver", "vendor": "Progressive Robot Ltd", "product": "hMailServer", "versions": [{"status": "affected", "version": "6.3.2", "lessThan": "6.3.6", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-10-08T12:17:16.937", "references": [{"url": "https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.6", "source": "cve@gitlab.com"}, {"url": "https://gitlab.com/hmailserver/hmailserver/-/work_items/66", "source": "cve@gitlab.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cve@gitlab.com", "description": [{"lang": "en", "value": "CWE-295"}]}], "descriptions": [{"lang": "en", "value": "Improper certificate validation in the webmail of Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote unauthenticated attacker to have S/MIME-encrypted mail that the account later sends to another correspondent also encrypted to the attacker's key. When its recipient opened a signed message, the webmail kept the signer's certificate for encrypting replies whether or not the server found its chain trusted, under the first e-mail address the certificate listed rather than the message's From address, and beside any certificate already held for that address. Encrypted mail later sent from the webmail to that address was encrypted to every certificate held for it, so a holder of the kept certificate's key who obtains a copy of such a message can read it."}], "lastModified": "2026-10-08T21:02:43.860", "sourceIdentifier": "cve@gitlab.com"}