The vulnerability is a missing authorization check in the Sieve notify action and the mail‑rule Reply action of Progressive Robot’s hMailServer. An authenticated user who can store a Sieve script or create a mail rule can cause the server to send a message where the From header is any address, including addresses that belong to domains hosted on the same server. When the chosen address is at a domain that is DKIM signed by the server, the generated message will be signed with that domain’s key, allowing the forged mail to pass DMARC checks and appear authentic to recipients. This capability is effectively impersonation of any address at the domain and can be used to send spam, phishing, or business‑email‑spoofing messages. The impact is that an attacker can transmit mail that appears to be from trusted domains without any further authorization.

The flaw affects hMailServer versions 6.2.22 through 6.3.6 for the Sieve notify action, and 6.0.0 through 6.3.6 for the mail‑rule Reply action. Any installation of hMailServer within those version ranges that allows users to create or store Sieve scripts (via ManageSieve, the REST API, or the administrative interface) or author mail rules is vulnerable.

The CVSS score of 6.5 indicates moderate severity. The EPSS score is not available, but the lack of a KEV listing suggests that exploitation has not been observed at scale yet. Nevertheless, because the attack requires only authenticated access—something that is typically easy to obtain on a mail server—and produces forged mail that can bypass common email authenticity checks, the risk to organizations that host user domains is non‑trivial. An attacker can therefore use the vulnerability to distribute mass phishing campaigns or to trick recipients into believing messages originate from legitimate senders.