The vulnerability permits an authenticated user to use Sieve’s *editheader* action or the mail‑rule "Set header value" action to modify any outgoing message header—including From, Sender, Resent‑From, Resent‑Sender, and DKIM‑Signature—except Received and Return‑Path. Because hMailServer signs the first delivery pass with the DKIM key for the domain named in the From header, an attacker can forge the From address, delete and re‑add it to a different sender, and redirect the message, resulting in a DKIM‑signed email that appears authentic and may pass DMARC checks. This facilitates phishing, domain spoofing, and other email‑based attacks.

The flaw affects Progressive Robot Ltd’s hMailServer across all releases from 6.2.22 through 6.3.6 inclusive. Any instance employing Sieve scripts or account/domain mail‑rules that alter header values is vulnerable, regardless of whether the server is exposed externally or internally.

With a CVSS score of 6.5 the vulnerability is rated moderate severity, and though no EPSS value is published, the existence of an authenticated exploitation path increases the risk. The flaw is not currently listed in CISA’s Known Exploited Vulnerabilities catalog. An attacker only needs valid account credentials, a domain‑administrator role, or an API key to deploy a Sieve script or rule that forwards or copies mail with a forged identity and legitimate DKIM signature, thereby compromising the integrity and authenticity of outbound messages.