HIGH🇵🇱 Wersja polska

CVE-2026-7807

CVSS 8.7v4.0pub. 2026-05-08upd. 2026-06-04

SmarterTools SmarterMail builds prior to 9560 contain a local file inclusion vulnerability in the /api/v1/report/summary/{type} API endpoint that allows authenticated users to read arbitrary .json files on the system. Attackers can exploit this vulnerability combined with weak encryption algorithms and hardcoded keys to decrypt and access stored passwords and 2FA secrets for all users.

CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Smartertools Smartermail

    APP
    Smartertools
    < 100.0.9560
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Path Traversal
CWE
References

Related vulnerabilities

CVE-2026-24423CRITICAL9.3⚠ KEVPL ✓ten sam produkt

SmarterMail – nieuwierzytelnione RCE przez ConnectToHub API

CVE-2026-23760CRITICAL9.3⚠ KEVPL ✓ten sam produkt

Pominięcie uwierzytelnienia w API resetowania hasła SmarterMail

CVE-2025-52691CRITICAL10.0⚠ KEVPL ✓ten sam produkt

Nieautoryzowany upload plików i RCE w SmarterMail (SmarterTools)

CVE-2021-32234CRITICAL9.8ten sam produkt

SmarterTools SmarterMail 16.x through 100.x before 100.0.7803 allows remote code execution.

CVE-2019-7214CRITICAL9.8ten sam produkt

SmarterTools SmarterMail 16.x before build 6985 allows deserialization of untrusted data. An unauthenticated a...