{"id":"CVE-2026-104660","revision":null,"records":[{"revision":"5238c1baa1da417e87095b5b43966115","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-104660","aliases":[],"title":"Missing Authorization in hMailServer","description":"Missing authorization on COM objects in Progressive Robot hMailServer 6.0.0 through 6.3.5 (Windows only) lets a local interactive user with no hMailServer credential read and write arbitrary files as the service account and queue mail as any sender. The service registers its COM classes with no DCOM access or launch permission and calls CoInitializeSecurity with no security descriptor, so any user logged on at the console or over Remote Desktop can activate the classes in the running service; a hMailServer.Message, its Attachments and Attachment, and a hMailServer.FetchAccount created this way carry a credential that never authenticated. Attachments.Add(path) and Attachment.SaveAs(path) performed no authorization check, and Message.Save/Copy and FetchAccount.AccountID/Save performed none either up to 6.3.3 and from 6.3.4 treated a holder with no credential as the server's own event-script host. Because the service does not impersonate the COM caller, Attachments.Add reads any file the service account can read and returns it, Attachment.SaveAs writes attacker-chosen bytes to any path it can write (on a LocalSystem installation, code execution as SYSTEM), Message.Save queues outbound mail from any address past the SMTP checks, and FetchAccount attaches a mail-fetch job to any mailbox. The objects an Application handed out behave the same once a later Authenticate on that Application fails.","state":0,"publishedAt":"2026-10-08T10:52:50.63+00:00","modifiedAt":"2026-10-08T14:25:20.499+00:00","affected":[{"ecosystem":"Vendor product","name":"hMailServer","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Progressive Robot Ltd\",\n                    \"product\": \"hMailServer\",\n                    \"repo\": \"https://gitlab.com/hmailserver/hmailserver\",\n                    \"versions\": [\n                        {\n                            \"version\": \"6.0.0\",\n                            \"status\": \"affected\",\n                            \"lessThan\": \"6.3.6\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://gitlab.com/hmailserver/hmailserver/-/work_items/59","https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.6"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-104660","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-104660","identifiers":["CVE-2026-104660"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-11T08:27:47.0671487+00:00","complete":true,"records":1779,"lastAttemptAt":"2026-11-11T08:27:47.0671487+00:00","lastSuccessAt":"2026-11-11T08:27:47.385057+00:00","error":null,"lastVerifiedAt":"2026-11-11T08:27:47.3850582+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-de3b77103708811b6494d2ff7c979037d73ae579742cd1649a5c765137ae5083-bc1226ead32dcd8585c64680277f32c2227e36291dbe8f063e7519b0a52c9d06","complete":true,"records":423984,"lastAttemptAt":"2026-11-11T08:25:46.003985+00:00","lastSuccessAt":"2026-11-11T08:25:45.9381066+00:00","error":null,"lastVerifiedAt":"2026-11-11T08:25:46.003985+00:00","snapshotPublishedAt":"2026-11-11T07:28:36+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-a5bcdf6ab6d94076983501bc0e56dd96","complete":false,"records":13754,"lastAttemptAt":"2026-11-11T08:39:48.5063796+00:00","lastSuccessAt":"2026-11-11T08:39:48.502+00:00","error":"16 identifier lookups failed; latest failures include HTTP 403. Other identifiers were checked independently.","lastVerifiedAt":"2026-11-11T08:39:48.502+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13770,"expectedIdentifiers":13808,"failedIdentifiers":16},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-11T08:27:47.0671487+00:00","complete":true,"records":1097,"lastAttemptAt":"2026-11-11T08:27:47.0671487+00:00","lastSuccessAt":"2026-11-11T08:27:47.3858436+00:00","error":null,"lastVerifiedAt":"2026-11-11T08:27:47.3858438+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-4463bca2214348638313ac7302b155ec","complete":true,"records":13748,"lastAttemptAt":"2026-11-11T08:27:47.8884887+00:00","lastSuccessAt":"2026-11-11T07:26:17.628+00:00","error":null,"lastVerifiedAt":"2026-11-11T07:26:17.628+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13808,"expectedIdentifiers":13808,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-3562b6c78fd1bd0f0b55daf66a0926ae24f65e462df7f6d928caad458fc696bf","complete":true,"records":9947,"lastAttemptAt":"2026-11-11T08:27:46.9180255+00:00","lastSuccessAt":"2026-11-11T04:27:43.6877707+00:00","error":null,"lastVerifiedAt":"2026-11-11T08:27:46.9180255+00:00","snapshotPublishedAt":"2026-11-11T03:32:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-456002455e0ab94bb92c95476d4e6d175c104cd594749982afd96c893728ecbc","complete":true,"records":2010,"lastAttemptAt":"2026-11-11T08:25:46.0590741+00:00","lastSuccessAt":"2026-11-11T02:36:58.1276999+00:00","error":null,"lastVerifiedAt":"2026-11-11T08:25:46.0590741+00:00","snapshotPublishedAt":"2026-11-11T01:17:51+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-0e3796c351bac632fda8fc3b3641da2bc6f0237cd79e78b1e59d17ce0aa22d32","complete":true,"records":3081,"lastAttemptAt":"2026-11-11T08:27:47.0269454+00:00","lastSuccessAt":"2026-11-10T20:24:10.5326555+00:00","error":null,"lastVerifiedAt":"2026-11-11T08:27:47.0269454+00:00","snapshotPublishedAt":"2026-11-10T20:03:04+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-085e065fc9050ae18408f7e722c39653aeb186872334d7b3ec1fcafb7ed43d25","complete":true,"records":231665,"lastAttemptAt":"2026-11-11T08:27:46.7420627+00:00","lastSuccessAt":"2026-11-11T08:27:45.2700102+00:00","error":null,"lastVerifiedAt":"2026-11-11T08:27:46.7420627+00:00","snapshotPublishedAt":"2026-11-11T07:32:59+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}