Hmailserver: Five High/Medium Severity Vulnerabilities Disclosed Together
Key findings • Five vulnerabilities in Hmailserver disclosed on October 19, 2026, with High and Medium severity ratings. • Local privilege escalation possible via incorrect installer permissi…
Key findings
- Five vulnerabilities in Hmailserver disclosed on October 19, 2026, with High and Medium severity ratings.
- Local privilege escalation possible via incorrect installer permissions in CVE-2026-107571.
- Remote DoS and email spoofing vulnerabilities (CVE-2026-107569, CVE-2026-107567) affect versions 6.0.0 through 6.3.6.
- Missing authorization flaws allow unauthorized mail sending in CVE-2026-107568 and CVE-2026-107566.
- Affected versions range from 6.0.0 to 6.3.6; prompt patching is advised.
On October 19, 2026, a batch of five vulnerabilities was disclosed for Hmailserver, a popular open-source mail server software. These vulnerabilities, disclosed on the same day, span a range of severities from Medium to High, with CVSS scores up to 7.8. The disclosures highlight issues in local privilege escalation, remote denial-of-service, unauthorized mail sending, and insecure DKIM signing.
Several of the vulnerabilities stem from improper handling of permissions and authorization. CVE-2026-107571, a High severity flaw, involves incorrect default permissions in the Windows installer. This could allow a local authenticated user to execute code with high-privileged accounts if the product is installed in a folder with inherited permissions from a writable parent.
Another High severity vulnerability, CVE-2026-107569, is due to unchecked input for a loop condition. This could permit a remote unauthenticated attacker to halt the mail server, disrupting mail delivery.
Medium severity issues, CVE-2026-107568 and CVE-2026-107566, both relate to missing authorization in specific mail rule actions. CVE-2026-107568 affects the Sieve notify action and mail-rule Reply action, while CVE-2026-107566 impacts the Sieve editheader action and mail-rule Set header value action. In both cases, an authenticated user could potentially send mail through the server masquerading as any address, with the latter also enabling DKIM signing for that forged address.
A distinct High severity vulnerability, CVE-2026-107567, concerns the DKIM signing process. An unauthenticated remote attacker could exploit this by using a less trusted source, leading to mail being signed with the DKIM key of a domain hosted by the server. This would allow the forged emails to pass DKIM and DMARC checks at recipient servers.
The affected versions for these vulnerabilities generally range from Hmailserver 6.0.0 through 6.3.6, with some specific versions noted for certain flaws (e.g., 6.2.22 through 6.3.6 for Sieve notify and editheader actions). Users are advised to update to a patched version as soon as possible to mitigate these risks. The timely disclosure of these vulnerabilities by the security community allows administrators to address potential security gaps in their Hmailserver deployments.
This batch of vulnerabilities underscores the importance of secure configuration and regular updates for mail server software. The range of issues, from local privilege escalation to remote denial-of-service and email spoofing, presents a multifaceted threat to organizations relying on Hmailserver. Administrators should review the specific CVE details and apply necessary patches to protect their mail infrastructure.