Description
Missing authorization in the REST and COM administration APIs of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote authenticated user whose credential is confined to named domains to change mail routing and domain configuration beyond those domains on a multi-tenant server. A domain administrator, an account or API key given another role that manages accounts in named domains, or a full-scope API key issued for named domains could create a domain alias for any name (so that other tenants' mail for that name is diverted to an address the attacker controls, or denied), rename a domain to any name the server does not host, set a rule's bind-to-address, send-using-route or script-function action to reach one of the server's own addresses, a configured route's stored credentials or a function of the server's event script, and set the domain's relay host - which delivery then connects to with no address rule - to an address on the server's own network; and over the COM API any account could set the three rule actions on its own rules, where the script-function action runs at delivery. The authorization gate did not refuse these routes to a confined credential and the handlers were not given the caller; over COM the domain-alias save performed no authorization check at all, the domain rename required only a domain administrator, and a rule save required at most that the caller could change the rule's owner.
Published: 2026-10-21
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Privilege Escalation
Action: Immediate Patch
AI Analysis

Impact

Missing authorization in the REST and COM administration APIs of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows an authenticated user with a credential limited to named domains to change mail routing and domain configuration beyond those domains on a multi-tenant server. The attacker can create domain aliases for any name, rename domains to names the server does not host, alter rule actions such as bind-to-address, send-using-route or script-function, configure a relay host to reach the server’s own network, and thereby divert or deny email traffic for other tenants. This unauthorized configuration change effectively escalates privileges on the mail server and can lead to data interception or denial of service for affected domains.

Affected Systems

The vulnerability affects Progressive Robot Ltd hMailServer versions 6.0.0 through 6.3.6. All installations that expose the REST API or allow COM API access on a multi-tenant environment are susceptible; users with any domain-restricted administrative rights are at risk.

Risk and Exploitability

The CVSS score of 8.1 indicates a high severity impact. EPSS data is unavailable, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no known widespread exploitation yet. The likely attack vector is remote authenticated access via the exposed REST or COM administration interfaces, requiring only valid credentials scoped to named domains. If such credentials exist, the attacker can fully manipulate routing and domain settings without further authorization checks.

Generated by OpenCVE AI on October 22, 2026 at 04:31 UTC.

Remediation

Vendor Solution

Upgrade to hMailServer 6.3.7, which refuses the domain-alias create, the domain rename and an internal relay host to a credential that is confined to named domains, and the reaching rule actions (bind-to-address, send-using-route, script-function on an owned rule) to anyone but the server administrator, over both the REST and the COM APIs, while keeping the changes that stay inside the credential's domains. Until then, on a multi-tenant server, do not give a domain-administrator credential, a role that manages accounts in named domains, or a named-domain API key to a party not trusted with the whole server; keep the REST API off (RestApiPort=0, the default) where it is not needed; and review existing domain aliases, domain names, relay hosts and account/domain rule actions for entries a confined credential should not have made, and the accounts' own rules for these three actions, which withholding such credentials does not stop an account setting on its own rules over COM (do this after upgrading as well, since an upgrade does not undo a change already made).

OpenCVE Recommended Actions

  • Upgrade hMailServer to version 6.3.7 or newer, which blocks domain‑alias creation, domain renaming, internal relay host changes, and restricted rule actions for non‑administrator credentials.
  • Disable the REST API in environments where it is not required by setting RestApiPort=0, thereby removing the exposure that can be abused.
  • Revoke any domain‑administrator or named‑domain API keys that are given to parties not fully trusted with the entire server, and audit existing domain aliases, domain names, relay hosts and account‑level rule actions for any unauthorized entries.

Generated by OpenCVE AI on October 22, 2026 at 04:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 29 Oct 2026 22:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 02:30:00 +0000

Type Values Removed Values Added
First Time appeared Progressive Robot
Progressive Robot hmailserver
Vendors & Products Progressive Robot
Progressive Robot hmailserver

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Description Missing authorization in the REST and COM administration APIs of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote authenticated user whose credential is confined to named domains to change mail routing and domain configuration beyond those domains on a multi-tenant server. A domain administrator, an account or API key given another role that manages accounts in named domains, or a full-scope API key issued for named domains could create a domain alias for any name (so that other tenants' mail for that name is diverted to an address the attacker controls, or denied), rename a domain to any name the server does not host, set a rule's bind-to-address, send-using-route or script-function action to reach one of the server's own addresses, a configured route's stored credentials or a function of the server's event script, and set the domain's relay host - which delivery then connects to with no address rule - to an address on the server's own network; and over the COM API any account could set the three rule actions on its own rules, where the script-function action runs at delivery. The authorization gate did not refuse these routes to a confined credential and the handlers were not given the caller; over COM the domain-alias save performed no authorization check at all, the domain rename required only a domain administrator, and a rule save required at most that the caller could change the rule's owner.
Title Missing Authorization in hMailServer
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Progressive Robot Hmailserver
cve-icon MITRE

Status: PUBLISHED

Assigner: GitLab

Published:

Updated: 2026-10-29T20:55:43.979Z

Reserved: 2026-10-21T15:33:56.489Z

Link: CVE-2026-114489

cve-icon Vulnrichment

Updated: 2026-10-29T17:52:00.496Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-21T16:17:35.500

Modified: 2026-10-29T21:17:12.427

Link: CVE-2026-114489

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T04:45:17Z

Weaknesses