---
id: CVE-2026-107587
title: >-
  Improper certificate validation in the webmail of Progressive Robot
  hMailServer 6.3.2 through 6.3.5 allows a remote unauthenticated attacker to
  have S/MIME-encrypted mail that the account later sends to another
  correspondent also encrypt…
summary: >-
  Improper certificate validation in the webmail of Progressive Robot
  hMailServer 6.3.2 through 6.3.5 allows a remote unauthenticated attacker to
  have S/MIME-encrypted mail that the account later sends to another
  correspondent also encrypt…
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N'
cwe:
  - CWE-295
vendor: Progressive Robot Ltd
product: hMailServer
affected:
  - hMailServer >= 6.3.2 < 6.3.6
published: '2026-10-08'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T15:17:45.033'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-107587'
references:
  - url: 'https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.6'
    label: cve@gitlab.com
  - url: 'https://gitlab.com/hmailserver/hmailserver/-/work_items/66'
    label: cve@gitlab.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-08T14:13:29.336107Z'
ingestedAt: '2026-10-08T12:39:48.758Z'
---

## Overview

Improper certificate validation in the webmail of Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote unauthenticated attacker to have S/MIME-encrypted mail that the account later sends to another correspondent also encrypted to the attacker's key. When its recipient opened a signed message, the webmail kept the signer's certificate for encrypting replies whether or not the server found its chain trusted, under the first e-mail address the certificate listed rather than the message's From address, and beside any certificate already held for that address. Encrypted mail later sent from the webmail to that address was encrypted to every certificate held for it, so a holder of the kept certificate's key who obtains a copy of such a message can read it.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.