Description
Insufficient preservation of the original sender in the forwarding of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have mail they write, naming in its From an address at a domain the server hosts, delivered to other receivers as passing that domain's DMARC policy. When the server sent on a copy of mail that came from outside - an account's forward, a mail rule's forward, a Sieve redirect, a list's copy, or an alias or list expanding to an outside address - it could give the copy an SMTP identity in the organisation of the domain the copy's From names, whatever the message's origin: with the Sender Rewriting Scheme or the rewrite of the envelope sender on forwarding enabled (both off by default), an address at the forwarding domain; for a list, its bounce address; for a message with an empty envelope sender, none, under the server's own host name; and an envelope sender the message came with at a subdomain of a hosted domain was kept. Where that identity's SPF record authorises the server, other receivers' SPF check of the copy passed for a domain aligned with the From, and DMARC passed with it, although the message had not passed DMARC when the server received it. Exploitation needs a forward, redirect, alias or list that carries the hosted domain's mail to an outside address, and one of: SRS or the envelope rewrite enabled; a list whose bounce address is in the domain's organisation; an envelope sender at a subdomain whose SPF record authorises the server; or, for an empty envelope sender, an SPF record that authorises the server under its host name. The DKIM route to the same result is CVE-2026-107567.
Published: 2026-10-21
Score: 5.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Mail spoofing with DMARC bypass
Action: Patch
AI Analysis

Impact

The defect in hMailServer 6.0.0 through 6.3.6 occurs when the server forwards or redirects mail from an internal account. The software fails to preserve the original envelope sender and, when features such as the Sender Rewriting Scheme (SRS) or envelope rewriting are enabled, replaces the sender with an address in the same domain as the recipient. Because the SPF record of that domain authorises the server, the forwarded message passes both SPF and DMARC checks at the destination even though the original message never passed DMARC. This allows an unauthenticated attacker to send a message to any local mailbox, set the From header to an address on a domain the server hosts, and have the message delivered to an external address as a domain‑aligned, DMARC‑compliant message. The vulnerability is a classic Confused Deputy flaw (CWE‑441) that can facilitate phishing, spoofing or bypass of email filtering.

Affected Systems

Affected software is Progressive Robot Ltd’s hMailServer, specifically versions 6.0.0 through 6.3.6. The vendor recommends upgrading to hMailServer 6.3.7, where forwarding logic has been corrected so that copies of mail forwarded from the host domain retain proper envelope sender handling and do not claim the host domain’s DMARC compliance incorrectly.

Risk and Exploitability

The CVSS score of 5.9 indicates medium severity. Exploitation requires an external actor to be able to send mail to a mailbox that forwards or redirects it to an external address. No active exploits are documented and the EPSS score is not available, but the flaw only needs standard mail configuration and does not require privileged access. Although the vulnerability is not listed in the CISA KEV catalog, its ability to enable domain‑aligned spoofed mail warrants timely remediation.

Generated by OpenCVE AI on October 22, 2026 at 03:50 UTC.

Remediation

Vendor Solution

Upgrade to hMailServer 6.3.7, in which a copy of mail from outside is sent on with an envelope sender, or under a host name, in the organisation of a domain its From names only when the message passed DMARC for that organisation when it arrived, a pass every copy of the message carries. Otherwise a forward, a Sieve redirect or a rule's forward keeps the envelope sender the message came with rather than an SRS or rewritten one; a copy whose identity would still be in that organisation - an empty envelope sender under a host name of it, or an envelope sender at the server's host name or in a hosted domain's organisation - is not sent to an outside address, nor is the message where an alias or a list expands to one; a managed list does not distribute the posting; and a distribution list's bounce address is not applied to it. Until then: keep SRS and the rewrite of the envelope sender on forwarding off where they are not needed; turn on the account option not to forward messages flagged as spam (ForwardAbortSpamFlagged) for accounts that forward to outside addresses, which does not hold a Sieve redirect; and set the DMARC test's score (DMARCFailureScore) at or above the spam delete threshold, so that a message that fails a published quarantine or reject policy is refused, or quarantined, on arrival. Neither of the last two holds mail in the name of a domain whose DMARC policy is none.

OpenCVE Recommended Actions

  • Upgrade to hMailServer 6.3.7, which corrects forwarding logic and protects the envelope sender.
  • Disable the Sender Rewriting Scheme (SRS) or envelope–rewriting feature unless explicitly required for other mail flow scenarios.
  • Configure the ‘ForwardAbortSpamFlagged’ account option for any account that forwards to external addresses and set the DMARCFailureScore to a level that rejects or quarantines messages which fail DMARC, ensuring that only legitimate outbound mail is sent.

Generated by OpenCVE AI on October 22, 2026 at 03:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 29 Oct 2026 22:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 02:30:00 +0000

Type Values Removed Values Added
First Time appeared Progressive Robot
Progressive Robot hmailserver
Vendors & Products Progressive Robot
Progressive Robot hmailserver

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Description Insufficient preservation of the original sender in the forwarding of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have mail they write, naming in its From an address at a domain the server hosts, delivered to other receivers as passing that domain's DMARC policy. When the server sent on a copy of mail that came from outside - an account's forward, a mail rule's forward, a Sieve redirect, a list's copy, or an alias or list expanding to an outside address - it could give the copy an SMTP identity in the organisation of the domain the copy's From names, whatever the message's origin: with the Sender Rewriting Scheme or the rewrite of the envelope sender on forwarding enabled (both off by default), an address at the forwarding domain; for a list, its bounce address; for a message with an empty envelope sender, none, under the server's own host name; and an envelope sender the message came with at a subdomain of a hosted domain was kept. Where that identity's SPF record authorises the server, other receivers' SPF check of the copy passed for a domain aligned with the From, and DMARC passed with it, although the message had not passed DMARC when the server received it. Exploitation needs a forward, redirect, alias or list that carries the hosted domain's mail to an outside address, and one of: SRS or the envelope rewrite enabled; a list whose bounce address is in the domain's organisation; an envelope sender at a subdomain whose SPF record authorises the server; or, for an empty envelope sender, an SPF record that authorises the server under its host name. The DKIM route to the same result is CVE-2026-107567.
Title Unintended Proxy or Intermediary ('Confused Deputy') in hMailServer
Weaknesses CWE-441
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N'}

Subscriptions

Progressive Robot Hmailserver
cve-icon MITRE

Status: PUBLISHED

Assigner: GitLab

Published:

Updated: 2026-10-29T20:55:51.043Z

Reserved: 2026-10-21T15:11:45.854Z

Link: CVE-2026-114478

cve-icon Vulnrichment

Updated: 2026-10-29T17:33:41.475Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-21T16:17:35.213

Modified: 2026-10-29T21:17:12.313

Link: CVE-2026-114478

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T04:00:10Z

Weaknesses
  • CWE-441

    Unintended Proxy or Intermediary ('Confused Deputy')