CVE-2026-7807: 
SmarterTools SmarterMail vulnerability analysis and mitigation

CVE-2026-7807 is a local file inclusion (LFI) vulnerability in SmarterTools SmarterMail affecting all builds prior to 9560. The flaw resides in the /api/v1/report/summary/{type} API endpoint, allowing authenticated users to read arbitrary .json files on the server. When chained with weak encryption algorithms and hardcoded cryptographic keys present in the application, attackers can decrypt and access stored passwords and 2FA secrets for all users on the system. It was published on May 8, 2026, with a CVSS v3.1 base score of 8.8 (High) and a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, VulnCheck).

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / Path Traversal). The {type} parameter in the /api/v1/report/summary/{type} API endpoint is not properly sanitized, allowing an authenticated attacker to supply path traversal sequences that cause the server to read arbitrary .json files outside the intended directory. The critical amplification factor is that SmarterMail stores user credentials and 2FA secrets in .json files encrypted with weak algorithms and hardcoded keys — meaning once an attacker reads these files, they can decrypt the contents offline without any additional server interaction (GitHub Advisory, VulnCheck).

Successful exploitation allows an authenticated attacker to read arbitrary .json files on the SmarterMail server, including those containing encrypted credentials and 2FA secrets for all users on the system. By leveraging the application's hardcoded encryption keys, the attacker can decrypt these files to obtain plaintext passwords and TOTP/2FA secrets, effectively bypassing multi-factor authentication for every account. This results in a full compromise of all user accounts on the mail server, with high confidentiality, integrity, and availability impact, and significant potential for lateral movement or account takeover across the organization (GitHub Advisory, VulnCheck).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The vulnerability requires a low-privilege authenticated account to exploit, lowering the barrier for insider threats or attackers who have obtained any valid credentials. The EPSS score is approximately 0.034% (4th percentile), indicating a currently low probability of exploitation in the near term. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog at this time. The vulnerability was assigned and disclosed by VulnCheck (VulnCheck).

1. Reconnaissance: Identify internet-facing SmarterMail instances running builds prior to 9560 using tools like Shodan or Censys, or by checking the SmarterMail web interface version information.
2. Obtain valid credentials: Acquire any low-privilege authenticated account on the target SmarterMail server (e.g., via phishing, credential stuffing, or a free/trial account if available).
3. Authenticate to the API: Log in to the SmarterMail API to obtain a valid session token or authentication cookie.
4. Exploit the LFI endpoint: Send a crafted HTTP GET request to /api/v1/report/summary/{type} with path traversal sequences in the {type} parameter to read arbitrary .json files outside the intended directory (e.g., user data or configuration files containing encrypted credentials).
5. Retrieve credential files: Target known file paths where SmarterMail stores user account data, passwords, and 2FA secrets in .json format.
6. Decrypt credentials offline: Using the application's hardcoded encryption keys (recoverable from the SmarterMail binaries) and the known weak encryption algorithm, decrypt the retrieved .json files to obtain plaintext passwords and 2FA secrets for all users.
7. Account takeover: Use the recovered credentials and 2FA secrets to authenticate as any user, including administrators, achieving full system compromise (GitHub Advisory, VulnCheck).

• Network: Unusual or repeated HTTP GET requests to /api/v1/report/summary/ with path traversal sequences (e.g., ../, %2e%2e%2f, or encoded variants) in the {type} parameter from authenticated sessions.
• Logs: SmarterMail API access logs showing requests to /api/v1/report/summary/ with unexpected or non-standard {type} values, particularly those referencing file paths outside the reports directory; multiple rapid API calls to this endpoint from a single authenticated user.
• File System: Evidence of access to .json files outside the intended reports directory, particularly user account data or configuration files containing credential data.
• Authentication: Unexpected logins from new IP addresses or geographic locations following API activity; successful authentications for accounts that should not be active or that have recently had credentials accessed via the API.

SmarterTools has released a patch in SmarterMail build 9560; all users should upgrade immediately (SmarterTools Release Notes). If immediate patching is not possible, restrict network access to the /api/v1/report/summary/ endpoint via firewall rules or reverse proxy ACLs, and enforce strong authentication controls. As a precautionary measure if exploitation may have occurred, reset passwords and 2FA credentials for all users. Review API access logs for suspicious requests to the affected endpoint (GitHub Advisory).

The vulnerability received standard automated coverage from security aggregators and threat intelligence feeds shortly after disclosure on May 8, 2026, including posts on Bluesky and coverage by RedPacket Security and The Hacker Wire (RedPacket Security). No notable independent researcher commentary or significant vendor statements beyond the patch release have been identified at this time.