Description
Use of a less trusted source for the envelope sender in the external-account download of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have mail they write in the name of a domain the server hosts sent on by the server with an envelope sender at that domain, so that it passes the domain's SPF and DMARC at other receivers. A message the server downloads from an external POP3 or IMAP account has no SMTP envelope of its own, and the server took the address in its From header as its envelope sender, whatever that address was. A forward or redirect of the downloaded message to an outside address then left with that address as its envelope sender, which the Sender Rewriting Scheme leaves alone for a hosted domain, so that the receiver's SPF check passed for the forged domain, aligned even under strict alignment, with no non-default setting, host name record or DMARC policy needed. An attacker needs to know a mailbox elsewhere that an account here collects and forwards to an outside address; an account holder who adds an external account of their own can collect from a server of their own, which matters where SmtpAuthenticatedSenderCheck holds signed-in senders to their own addresses.
Published: 2026-10-21
Score: 5.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Email spoofing bypassing SPF and DMARC
Action: Patch
AI Analysis

Impact

Use of a less trusted source for the envelope sender in external‑account downloads allows a remote unauthenticated attacker to have mail written in the name of a domain the server hosts sent on with that domain as the envelope sender, thereby passing SPF and DMARC checks at recipients. The server takes the From header address for the envelope sender when no SMTP envelope exists, and a forwarded or redirected copy retains that sender. This can be used to deliver spoofed messages that appear legitimate to recipient mail systems.

Affected Systems

Progressive Robot Ltd hMailServer versions 6.0.0 through 6.3.6 are affected. The issue does not exist in hMailServer 6.3.7 and later, where the envelope sender remains empty for downloads and correct rewrite rules are applied.

Risk and Exploitability

The CVSS score of 5.9 indicates moderate severity. EPSS is unavailable, but the vulnerability remains exploitable by any external threat actor who can cause the server to download and forward email from an external account. The attack requires no authentication to the hMailServer instance. The vulnerability is not listed in the CISA KEV catalog. Because enforcement of SPF and DMARC is failure‑safe, an attacker can successfully bypass domain authentication checks at the receiver, creating a realistic risk of phishing or spam.

Generated by OpenCVE AI on October 22, 2026 at 03:53 UTC.

Remediation

Vendor Solution

Upgrade to hMailServer 6.3.7, in which a download does not take an address hosted on the server from its From as its envelope sender - it keeps the empty envelope sender, as a download whose From names no address does - and a forward or redirect of it is held to the rule 6.3.7 applies to every copy of mail from outside: it is sent on with an envelope sender, or under a host name, in the organisation of a domain its From names only when the message passed DMARC for that organisation when it arrived, which a download never has. Until then, do not forward or redirect to an outside address the mail of an account that collects an external mailbox where that mail's From can name a domain the server hosts; the spam checks of an external account are off unless they are set, and a download has no DMARC verdict of its own to hold it.

OpenCVE Recommended Actions

  • Upgrade Progressive Robot hMailServer to version 6.3.7 or later to fix the envelope sender handling for external downloads.
  • As a temporary measure, avoid forwarding or redirecting messages that have been downloaded from external POP3 or IMAP accounts, or configure the server to use a default empty envelope sender for such messages.
  • Implement additional outbound mail filtering or DMARC enforcement on recipient servers to detect and reject messages that claim to originate from domains the server hosts but are not truly sent by an authenticated user.

Generated by OpenCVE AI on October 22, 2026 at 03:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 29 Oct 2026 22:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 03:15:00 +0000

Type Values Removed Values Added
First Time appeared Progressive Robot
Progressive Robot hmailserver
Vendors & Products Progressive Robot
Progressive Robot hmailserver

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Description Use of a less trusted source for the envelope sender in the external-account download of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have mail they write in the name of a domain the server hosts sent on by the server with an envelope sender at that domain, so that it passes the domain's SPF and DMARC at other receivers. A message the server downloads from an external POP3 or IMAP account has no SMTP envelope of its own, and the server took the address in its From header as its envelope sender, whatever that address was. A forward or redirect of the downloaded message to an outside address then left with that address as its envelope sender, which the Sender Rewriting Scheme leaves alone for a hosted domain, so that the receiver's SPF check passed for the forged domain, aligned even under strict alignment, with no non-default setting, host name record or DMARC policy needed. An attacker needs to know a mailbox elsewhere that an account here collects and forwards to an outside address; an account holder who adds an external account of their own can collect from a server of their own, which matters where SmtpAuthenticatedSenderCheck holds signed-in senders to their own addresses.
Title Use of Less Trusted Source in hMailServer
Weaknesses CWE-348
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N'}

Subscriptions

Progressive Robot Hmailserver
cve-icon MITRE

Status: PUBLISHED

Assigner: GitLab

Published:

Updated: 2026-10-29T20:56:19.809Z

Reserved: 2026-10-21T15:11:25.855Z

Link: CVE-2026-114474

cve-icon Vulnrichment

Updated: 2026-10-29T17:33:15.905Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-21T16:17:34.707

Modified: 2026-10-29T21:17:11.900

Link: CVE-2026-114474

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T04:00:10Z

Weaknesses
  • CWE-348

    Use of Less Trusted Source