CVE-2026-7807 - Vulnerability Analysis

Overview

SmarterTools SmarterMail < 9560 contains a local file inclusion vulnerability caused by improper validation in /api/v1/report/summary/{type} endpoint, letting authenticated users read arbitrary JSON files and access sensitive credentials.

Severity & Score

Impact

Authenticated attackers can read sensitive files, decrypt stored passwords and 2FA secrets, compromising all user accounts.

Mitigation

Upgrade to version 9560 or later.

References

• https://www.smartertools.com/smartermail/release-notes/current
• https://www.vulncheck.com/advisories/smartertools-smartermail-build-9560-server-local-file-inclusion-via-the-api-v1-report-summary-type-api

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner