CVE-2026-107568
Received Received - Intake

Authorization Bypass in hMailServer Sieve Notify and Mail-Rule Reply

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: GitLab Inc.

Description
Missing authorization in the Sieve notify action (6.2.22 through 6.3.6) and in the mail-rule Reply action (6.0.0 through 6.3.6) of Progressive Robot hMailServer allows an authenticated user to send mail through the server as any address. A Sieve notify sends a notification message, and its :from tag names the sender; the server set the notification's From header to that :from as the script wrote it, without checking that the address belongs to the account - the check that the Sieve vacation action applies to its own :from, and that the server applies to the sender of mail queued over COM or sent from the webmail. An account that can store a Sieve script (over ManageSieve, the REST API's self-service filter, or the administration interface) could therefore have the server send a notification from any address, on this server or anywhere; and where the claimed address is at a domain the server hosts with DKIM signing enabled, the server signed the notification with that domain's DKIM key, because it signs by the From header's domain, producing forged mail aligned to pass the domain's DMARC policy. The notify action and this behaviour were introduced in 6.2.22. In the mail-rule engine, a rule's Reply was likewise sent from whatever address the action named, whoever the rule belonged to, so that an account acting on its own rules over COM, a domain administrator, or an API key confined to a domain (over the REST API from 6.3.4) could have a domain's or an account's rule reply from any address, signed, where that address is at a domain the server hosts with DKIM signing enabled, with that domain's key.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-107568
EUVD
EUVD-2026-104407

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Progressive Robot Ltd hMailServer 6.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves missing authorization checks in hMailServer's Sieve notify action and mail-rule Reply action. An authenticated user can send mail or notifications from any address, including addresses not belonging to their account. This is possible because the server does not validate the sender address in these actions, allowing for potential spoofing and forged emails.

Detection Guidance

Check hMailServer logs for unusual mail activity, especially notifications or replies sent from unauthorized addresses. Review Sieve scripts and mail rules for any actions that set custom From headers or reply addresses. Monitor DKIM-signed emails from your server to detect forged sender domains.

Impact Analysis

This vulnerability allows attackers to send emails or notifications from any address, including addresses they do not own. If the server hosts domains with DKIM signing enabled, the forged emails will appear legitimate and pass DMARC checks, potentially leading to phishing attacks, reputation damage, or unauthorized communications.

Compliance Impact

This vulnerability could lead to unauthorized email transmissions, potentially violating data protection and privacy regulations like GDPR or HIPAA by enabling spoofed communications. Organizations using affected hMailServer versions may fail compliance audits due to inadequate access controls and email authentication.

Mitigation Strategies

Upgrade hMailServer to a patched version beyond 6.3.6. Disable Sieve notify and mail-rule Reply actions if not needed. Restrict ManageSieve and REST API access to trusted users only. Review and remove any suspicious Sieve scripts or mail rules.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-107568. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart