Missing authorization in the REST role‑management routes of hMailServer 6.3.4 through 6.3.6 means a remote authenticated user whose credential is confined to named domains can create, update, or delete custom roles that belong to accounts in other domains. Because the manage_roles permission is only granted to serveradmin, and a confined credential can hold that permission, the server incorrectly allows the manipulation of cross‑domain custom roles. The attacker can raise or lower permissions of a role that is held by users in other domains, effectively granting undue mailbox and configuration privileges. The custom role itself cannot grant server‑level privileges, so the elevation is limited to role‑based permissions.

The affected systems are Progressive Robot Ltd’s hMailServer product, versions 6.3.4 through 6.3.6, on installations that expose the REST API (RestApiPort > 0). Any domain‑restricted API key or serveradmin privilege confined to specific domains permits exploitation.

The CVSS base score is 6.5, indicating a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote authenticated access to the REST API with a credential that is already limited to named domains. The lack of proper authorization gating on the create, update and delete routes is explicitly stated, so an attacker can manipulate cross‑domain roles if they possess such a credential. The exploitation conditions are relatively straightforward given the missing checks, but the actual exploitation likelihood depends on the presence of exposed APIs and domain‑restricted credentials.