CVE-2026-114477 reveals a missing authorization check in the REST metrics route of hMailServer. An authenticated user whose credentials are limited to a specific domain can request the /api/v1/metrics/history endpoint, which returns aggregated traffic counters for the entire mail server. The exposed data are only aggregate operational metrics and do not include individual message contents or account information.

The flaw affects Progressive Robot Ltd’s hMailServer products versions 6.2.25 through 6.3.6 on installations that have the REST API enabled. The vulnerability becomes apparent when a domain-identified credential, such as a domain administrator, an auditor role, or a domain-scoped API key, is used to access the endpoint. Because the route was not covered by the server’s authorization gate, any user with such a confined credential can obtain the server‑wide traffic history.

The CVSS score of 4.3 indicates low severity, and no EPSS value is published, so the likelihood of public exploitation is poorly understood. The involved attack vector is remote authenticated, and the vulnerability is not listed in the CISA KEV collection. Attackers who succeed could gather aggregate traffic statistics that might aid in operational reconnaissance, but they cannot read private mail or user data. The risk is therefore limited to information disclosure of aggregate usage metrics.