An improper authorization check in the REST administration API of hMailServer allows a remote authenticated user who owns the manage_roles permission within named domains to remove a narrowing role from an account that has server administrator authority. By changing the role assignment, the attacker can cause the account’s admin level to revert to the server administrator level and then set that account’s password to gain full administrative control. This flaw is a CWE‑863 type misauthorization vulnerability that enables privilege escalation.

Progressive Robot Ltd’s hMailServer versions 6.3.4 through 6.3.6 are affected. The vulnerability resides in the REST administration API endpoints that manage role assignments, and it can be exploited by accounts that have the manage_roles capability in specific domains. Users of these versions should verify the presence of the issue and ensure they are not using full‑scope API keys or serveradmin roles with domain‑level scoping that could be leveraged for escalation.

With a CVSS score of 7.5, the vulnerability is classified as high severity. The EPSS score is not available, and it is not listed in CISA’s KEV catalog, implying no known public exploitation yet. The attack requires a valid authenticated session and the manage_roles permission within the targeted domain(s). Once the attacker removes a narrowing role from an account that originally had server administrator authority, they can change that account’s password and then authenticate as the server administrator, gaining unrestricted control over the email server. Therefore, the risk is significant, especially in environments where domain‑specific API keys are widely distributed.