Windows Installer Default Permissions Expose Mail Server Data

Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a local authenticated user to read the mail server's data. The installer created the data, log, temp, database and event folders and the hMailServer.INI configuration file with the permissions inherited from the installation folder, by default under Program Files, which give the local Users group read access. Any user who can sign in to the computer could read every stored message, the logs, the built-in database with the accounts' password hashes whenever the service is stopped, and the configuration file, including the database password, which is sealed only with the machine's DPAPI key and can be unsealed by any local account; with an external database that password gives full control of it. The Linux AppImage of 6.3.0 through 6.3.5 likewise created its per-user data folders readable by other local users.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-107573 reveals a critical privilege escalation vulnerability in Progressive Robot hMailServer versions 6.0.0 through 6.3.5, where the Windows installer incorrectly applies default NTFS permissions to sensitive directories and configuration files. The installer creates data, log, temp, database, and event folders along with the hMailServer.INI configuration file with permissions inherited from the Program Files directory, inadvertently granting the local Users group read access. This means any authenticated user with local system access—including low-privileged accounts, contractors, or compromised service accounts—can read the complete mail server database, including all stored messages, attachments, and sensitive credentials. For organizations running hMailServer as their mail infrastructure, this vulnerability directly exposes confidential communications, personal data, and potentially regulatory-protected information (PII, PHI, financial records) to unauthorized disclosure.

Casky.ai's 224 mapped security skills detect the attack patterns underlying this vulnerability by analyzing indicators aligned with MITRE ATT&CK technique TA0004 (Privilege Escalation). Practitioners using Casky would identify suspicious file access attempts on hMailServer directories through behavioral analysis of process execution and file system interactions—specifically detecting when non-service accounts enumerate or read from restricted mail storage paths. The platform's extended reasoning capabilities would flag misconfigurations in NTFS permissions on critical application folders during system hardening assessments, correlating weak ACLs with the known vulnerable installer behavior. Security teams would see findings highlighting unauthorized file read attempts on hMailServer.INI and database folders, combined with recommendations to remediate permissions to restrict access to only the hMailServer service account and administrators—enabling proactive threat hunting before data exfiltration occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-107573.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-107573

Casky has 224 skills that investigate the attack patterns behind CVE-2026-107573. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn