High severity · published May 8, 2026
CVE-2026-7807
SmarterTools SmarterMail < Build 9560 Server Local File Inclusion via the /api/v1/report/summary/{type} API
8.8
CVSS
0.3%
EPSS
No
On KEV
Description
SmarterTools SmarterMail builds prior to 9560 contain a local file inclusion vulnerability in the /api/v1/report/summary/{type} API endpoint that allows authenticated users to read arbitrary .json files on the system. Attackers can exploit this vulnerability combined with weak encryption algorithms and hardcoded keys to decrypt and access stored passwords and 2FA secrets for all users.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SM
SmarterMail · SmarterTools Inc.
before 9560 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-7807
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-7807
Release Notes
https://www.smartertools.com/smartermail/release-notes/current
Third Party Advisory
https://www.vulncheck.com/advisories/smartertools-smartermail-build-9560-server-local-file-inclusion-via-the-api-v1-report-summary-type-api
More from SmarterMail
9.1
CVE-2026-40514
SmarterTools SmarterMail < Build 9610 Cryptographic Weakness via Weak RNG