CVE-2026-114489

Awaiting Analysis Awaiting Analysis - Queue

Authorization Bypass in hMailServer REST and COM APIs

Publication date: 2026-10-21

Last updated on: 2026-10-29

Assigner: GitLab Inc.

Description

Missing authorization in the REST and COM administration APIs of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote authenticated user whose credential is confined to named domains to change mail routing and domain configuration beyond those domains on a multi-tenant server. A domain administrator, an account or API key given another role that manages accounts in named domains, or a full-scope API key issued for named domains could create a domain alias for any name (so that other tenants' mail for that name is diverted to an address the attacker controls, or denied), rename a domain to any name the server does not host, set a rule's bind-to-address, send-using-route or script-function action to reach one of the server's own addresses, a configured route's stored credentials or a function of the server's event script, and set the domain's relay host - which delivery then connects to with no address rule - to an address on the server's own network; and over the COM API any account could set the three rule actions on its own rules, where the script-function action runs at delivery. The authorization gate did not refuse these routes to a confined credential and the handlers were not given the caller; over COM the domain-alias save performed no authorization check at all, the domain rename required only a domain administrator, and a rule save required at most that the caller could change the rule's owner.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-29

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-09

NVD

CVE-2026-114489

EUVD

EUVD-2026-107328

Affected Vendors & Products

Vendor	Product	Version / Range
Progressive Robot Ltd	hMailServer	6.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

CVE-2026-114489 is a missing authorization flaw in hMailServer's REST and COM APIs affecting versions 6.0.0 through 6.3.6. A remote authenticated user with domain-confined credentials can perform actions beyond their permitted scope in multi-tenant environments. This includes creating domain aliases, renaming domains, modifying mail routing rules, and configuring relay hosts to divert or block mail for other domains.

Detection Guidance

To detect this vulnerability, check hMailServer logs for unauthorized domain alias creation, domain renaming, or rule modifications. Review REST and COM API access logs for actions performed by confined credentials beyond their domain scope. Look for unexpected relay host configurations or script-function rule actions targeting server addresses.

Impact Analysis

An attacker could intercept, deny, or redirect emails for other domains hosted on the same server. They may execute unauthorized scripts during mail delivery or disrupt mail routing entirely. The impact is limited to multi-tenant setups where multiple independent domains share a single hMailServer instance.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive email data, violating confidentiality requirements in GDPR and HIPAA. Mail interception or denial of service may result in non-compliance with data protection and availability standards.

Mitigation Strategies

Immediately upgrade hMailServer to version 6.3.7 or later. Disable the REST API if not required. Restrict privileged credentials to their designated domains and audit API keys for excessive permissions. Monitor for suspicious domain alias or rule changes.

Hi! I’m here to help you understand CVE-2026-114489. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...