{"id":"CVE-2026-126621","summary":"Improper Certificate Validation in hMailServer","details":"Progressive Robot hMailServer 6.0.0-B1 through 6.3.7 on Windows hands OpenSSL the names of its own TLS files - the listeners' certificates, chains, private keys and Diffie-Hellman parameters, a port's client-certificate CA file (from 6.2.19), the object store's CA file (from 6.3.4) and the ACME client's keys and certificates - as Latin-1 bytes, which on code page 1252 are the code page's own for U+00A0 to U+00FF, and OpenSSL's file opening on Windows reads a name as UTF-8 first and opens the file at that reading when it is there, or creates it there when its folder is. When every byte of a configured name outside ASCII also reads as UTF-8 - for example U+00C3 U+00A9, the bytes C3 A9, which are U+00E9 in UTF-8 - the server used the file at that other name whenever one was there, which allows a local attacker who can create that file or its folder but cannot change the configured one, as any user can by default beside a file an administrator keeps under ProgramData, to have a port that logs on by client certificate (from 6.2.25) accept certificates from a certificate authority of the attacker's own and so sign in over the network as any mailbox without its password; to have the server trust such an authority for its object store and, intercepting that connection, read and modify the messages it stores; to receive the private keys the ACME client writes, the key of a certificate issued for the server's names among them; or to keep TLS ports from starting. The configuration is not the default: by default these files have names in ASCII, client certificates are off on every port, and the object store and ACME are off. The Linux builds are not affected.","modified":"2026-11-13T02:47:25.535709348Z","published":"2026-11-11T08:36:26.283Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126621.json","cna_assigner":"GitLab","cwe_ids":["CWE-295"]},"references":[{"type":"WEB","url":"https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8"},{"type":"WEB","url":"https://gitlab.com/hmailserver/hmailserver/-/work_items/115"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126621.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126621"},{"type":"PACKAGE","url":"https://gitlab.com/hmailserver/hmailserver"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://gitlab.com/hmailserver/hmailserver","events":[{"introduced":"6db50deceeb402ba46ca75b5aa461cd346919e63"},{"last_affected":"31d656c0ce85650202b2c0f70bdd1cffa7243e34"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"6.0.0-B1"},{"last_affected":"6.3.7"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"},{"range":[{"introduced":"6.0.0-B1"},{"last_affected":"6.3.7"}],"source":"DESCRIPTION"}]}}],"versions":["v6.3.7","build-inputs-2","v6.3.6","v6.3.5","v6.3.4","v6.3.3","v6.3.2","build-inputs-1","v6.3.1","v6.3.0","v6.2.28","v6.2.27","v6.2.26","v6.2.25","v6.2.24","v6.2.23-alpha2","v6.2.23-alpha1","v6.2.22-pre6","v6.2.22-pre5","v6.2.22-pre4","v6.2.22-pre3","v6.2.22-pre2","v6.2.22-pre1","v6.2.21","v6.2.20","v6.2.19","v6.2.18","v6.2.17","v6.2.16","v6.2.15","v6.2.14","v6.2.13","v6.2.12","v6.2.11","v6.2.10","v6.2.9","v6.2.8","v6.2.7","v6.2.6","v6.2.5","v6.2.4","v6.2.3","v6.2.2","v6.2.1","v6.2.0","v6.1.0","v6.0.0-B4","v6.0.0-B3","v6.0.0","v6.0.0-B1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126621.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}