SmarterTools SmarterMail CVE-2026-7807: Local File Inclusion Exposes Passwords

The National Vulnerability Database has detailed CVE-2026-7807, a high-severity local file inclusion vulnerability impacting SmarterTools SmarterMail builds prior to 9560. This flaw resides in the /api/v1/report/summary/{type} API endpoint, allowing authenticated users to read arbitrary .json files on the system.

The real punch comes when this vulnerability is chained. According to the National Vulnerability Database, attackers can combine the file inclusion with weak encryption algorithms and hardcoded keys to decrypt and access stored passwords and 2FA secrets for all users. This isn’t just about reading logs; it’s a direct path to full account compromise and potentially wider network access. The CVSS score of 8.1 (HIGH) reflects this critical impact, highlighting the potential for complete confidentiality, integrity, and availability compromise.

For defenders, this means a compromised SmarterMail instance could quickly escalate to an organizational breach. The attacker’s calculus here is straightforward: gain initial access, exploit this LFI to dump credentials, and then pivot. The fact that it’s an authenticated user requirement is a minor hurdle when weak credentials or phishing are always in play. This is a critical vector for lateral movement and privilege escalation within an environment.