CVE-2026-114477

Awaiting Analysis Awaiting Analysis - Queue

Missing Authorization in hMailServer REST Metrics Route

Publication date: 2026-10-21

Last updated on: 2026-10-29

Assigner: GitLab Inc.

Description

Missing authorization in the REST metrics route of Progressive Robot hMailServer 6.2.25 through 6.3.6 allows a remote authenticated user whose credential is confined to named domains to read the server-wide traffic history. GET /api/v1/metrics/history returns the server's traffic counters over the last 30 days; those counters are server-wide and carry no domain, which is why the report routes already refuse the same counters to a credential confined to named domains. The metrics route was not among the routes the server's authorization gate refuses a confined credential and its handler was not given the caller, so a domain administrator, an account given another role that holds view_configuration in named domains (the auditor role given a domain list among them), or an API key issued for named domains could read the whole server's traffic totals rather than its own domains'. The disclosure is of aggregate operational counters, not of any message or account.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-29

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-09

NVD

CVE-2026-114477

EUVD

EUVD-2026-107320

Affected Vendors & Products

Vendor	Product	Version / Range
Progressive Robot Ltd	hMailServer	6.2.25

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability is a missing authorization issue in hMailServer versions 6.2.25 through 6.3.6. A remote authenticated user with domain-confined credentials can access server-wide traffic history via the REST API endpoint GET /api/v1/metrics/history. This endpoint returns aggregate traffic counters over the last 30 days, which domain-confined credentials should not be able to view.

Detection Guidance

To detect this vulnerability, check if the REST API endpoint GET /api/v1/metrics/history is accessible to domain-confined credentials. Monitor logs for unauthorized access attempts to this endpoint. Ensure the hMailServer version is between 6.2.25 and 6.3.6. Test by attempting to access the endpoint with a domain-confined user account.

Impact Analysis

An attacker with domain-confined credentials (like domain admin or auditor) could read server-wide traffic data, including total mail handled and spam counts. This exposes operational metrics that should remain restricted to server administrators.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by exposing server-wide traffic metrics to unauthorized domain-confined users. GDPR requires strict access controls to prevent unauthorized data exposure, while HIPAA mandates safeguards for protected health information. Unauthorized access to aggregate operational data may violate these regulations if such data includes sensitive information.

Mitigation Strategies

Upgrade hMailServer to version 6.3.7 or later to fix the authorization issue. Avoid granting domain-admin roles or domain-scoped API keys to untrusted parties. Disable the REST API if it is not required. Review and restrict access to the /api/v1/metrics/history endpoint.

Hi! I’m here to help you understand CVE-2026-114477. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...