The vulnerability is an incorrect authorization check in the COM administration API of hMailServer versions 6.3.4 through 6.3.6. An account that has been granted the serveradmin role with a list of domains can act as a full‑server administrator, allowing it to read and modify every domain's accounts and mail, rename domains, create domain aliases, change server settings and secrets, and create additional server‑administrator accounts. The intended restriction that limits the serveradmin role to the domains named in its list is bypassed entirely by the COM API, which treats the administer_server permission as global regardless of the list. A similar flaw exists for the domainadmin role with a domain list, allowing it to administer all ordinary accounts across domains via COM. This flaw enables privilege escalation to the level of a full server administrator, with broad confidentiality, integrity, and availability impact.

Progressive Robot Ltd's hMailServer, versions 6.3.4, 6.3.5, and 6.3.6, are impacted.

The CVSS score of 7.8 reflects significant impact and the requirement for authenticated access to the COM API. The EPSS score is not available, but the known exploitation scenario uses the Control Panel or scripts running on the host that invoke the COM interface. Because the flaw is not publicly disclosed as an exploit and is not listed in the CISA KEV catalog, the probability of exploitation is uncertain, yet the potential damage is high. The vulnerability can be leveraged by any administrator who mistakenly grants a serveradmin role with a domain list, or by an attacker who gains such a credential. Unauthorized full‑server administration can be achieved if the COM interface is reachable, making the attack vector an authenticated COM call.