CVE-2026-114490

Awaiting Analysis Awaiting Analysis - Queue

Incorrect Authorization in hMailServer COM API

Publication date: 2026-10-21

Last updated on: 2026-10-29

Assigner: GitLab Inc.

Description

Incorrect authorization in the COM administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows an account assigned the serveradmin role with a list of domains - a credential an administrator may create meaning to confine it to those domains - to act as the whole-server administrator over COM. Administrator roles are meant to confine such a credential to the domains its list names, and the REST API did not take it for the server administrator, but the COM API's server-administrator check read the administer_server permission as the whole server whatever list the grant carried. So the credential signed in through the Control Panel, or through a script run on the server, as the server administrator of every domain: it could read and change every domain's accounts and mail, rename any domain, map a domain alias onto any, write the server's settings and secrets, and create further server-administrator accounts. The COM API's domain-administrator check, asked with no domain, likewise let an account assigned the domainadmin role with a list of domains that leaves out the account's own domain administer that domain's ordinary accounts over COM. An account holding serveradmin with no list is the server administrator by design and is unaffected, as are the help desk, auditor and custom roles.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-29

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-09

NVD

CVE-2026-114490

EUVD

EUVD-2026-107329

Affected Vendors & Products

Vendor	Product	Version / Range
Progressive Robot Ltd	hMailServer	6.3.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

CVE-2026-114490 is an authorization flaw in hMailServer's COM administration API affecting versions 6.3.4 through 6.3.6. It allows accounts with restricted serveradmin or domainadmin roles to bypass domain confinement and gain full server administrator privileges. The COM API incorrectly grants access to all domains regardless of role restrictions, while the REST API enforces them correctly.

Detection Guidance

Check hMailServer logs for unusual administrative actions performed via COM API, especially by accounts with serveradmin or domainadmin roles. Review role assignments in the Control Panel to identify accounts with restricted domain lists that may have excessive privileges.

Impact Analysis

An attacker with limited access could escalate privileges to control all domains, read/modify emails, change server settings, create new admin accounts, or map domain aliases. This affects Windows systems only since the COM API is Windows-specific. Impact includes unauthorized data access, service disruption, and potential data breaches.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations may face compliance violations, regulatory fines, and reputational damage due to potential data exposure or unauthorized modifications to email systems.

Mitigation Strategies

Avoid assigning serveradmin roles with domain lists or domainadmin roles excluding their own domain. Temporarily restrict COM API access until upgrading to hMailServer 6.3.7 or later. Review and revoke unnecessary administrative privileges.

Hi! I’m here to help you understand CVE-2026-114490. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...