PT-2026-39193 · Smartertools · Smartermail

Dninh · Published 2026-05-08 · Updated 2026-06-04 · CVE-2026-7807

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SmarterTools SmarterMail versions prior to 9560

Description An issue in the '/api/v1/report/summary/{type}' API endpoint allows authenticated users to perform local file inclusion, enabling the reading of arbitrary .json files on the system. This can be combined with hardcoded keys and weak encryption algorithms to decrypt and access stored passwords and 2FA secrets for all users.

Recommendations Update to build 9560 or later. Restrict access to the '/api/v1/report/summary/{type}' API endpoint to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-7807

Affected Products

Smartermail

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-7807 · Security Note
• https://smartertools.com/smartermail/release-notes/current · Patch
• https://vulncheck.com/advisories/smartertools-smartermail-build-9560-server-local-file-inclusion-via-the-api-v1-report-summary-type-api · Note
• https://t.me/CVEtracker/53161 · Telegram Post
• https://twitter.com/CVEnew/status/2053131444332187885 · Twitter Post
• https://t.me/cveNotify/166024 · Telegram Post