The vulnerability is a CSRF flaw in the REST API of Progressive Robot hMailServer 6.0.0 through 6.3.6. It permits a remote attacker to trick an authenticated user's browser into sending a state‑changing request when the attacker’s page is loaded, because HTTP Basic credentials are cached and the server accepts the request without verifying the request origin. The attacker cannot read the response, so the exploit is blind, but it can create or modify domains, accounts, API keys, or change service settings, effectively granting the attacker the privileges of the compromised administrator user.

Affected are installations of hMailServer from Progressive Robot Ltd built before version 6.3.7, specifically versions 6.0.0 through 6.3.6. The REST API is reachable if RestApiPort is enabled and the server is bound to a public interface; if the port is disabled or bound to loopback, the vulnerability is not exploitable.

The vulnerability has a CVSS score of 5.3, indicating moderate severity. EPSS is not published, and the issue is not listed in the CISA KEV catalog, so exploitation is not yet proven in the wild. The likely attack vector is a cross‑site page that the victim visits while holding cached Basic credentials; the attacker must have a user who has authenticated through the REST API basic prompt. Given that the bug only allows silent, state‑changing actions without response observation, the exploit requires the victim to be a privileged user and stay logged in. Overall the risk is moderate but should be mitigated promptly.