Incorrect Authorization in hMailServer
Summary
| CVE | CVE-2026-114490 |
|---|---|
| State | PUBLISHED |
| Assigner | GitLab |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-10-21 16:17:35 UTC |
| Updated | 2026-10-21 16:17:35 UTC |
| Description | Incorrect authorization in the COM administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows an account assigned the serveradmin role with a list of domains - a credential an administrator may create meaning to confine it to those domains - to act as the whole-server administrator over COM. Administrator roles are meant to confine such a credential to the domains its list names, and the REST API did not take it for the server administrator, but the COM API's server-administrator check read the administer_server permission as the whole server whatever list the grant carried. So the credential signed in through the Control Panel, or through a script run on the server, as the server administrator of every domain: it could read and change every domain's accounts and mail, rename any domain, map a domain alias onto any, write the server's settings and secrets, and create further server-administrator accounts. The COM API's domain-administrator check, asked with no domain, likewise let an account assigned the domainadmin role with a list of domains that leaves out the account's own domain administer that domain's ordinary accounts over COM. An account holding serveradmin with no list is the server administrator by design and is unaffected, as are the help desk, auditor and custom roles. |
Risk And Classification
Primary CVSS: v3.1 7.8 HIGH from [email protected]
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Problem Types: CWE-863 | CWE-863 CWE-863: Incorrect Authorization
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 7.8 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | CNA | CVSS | 7.8 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
CVSS v3.1 Breakdown
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Progressive Robot Ltd | HMailServer | affected 6.3.4 6.3.6 semver | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| gitlab.com/hmailserver/hmailserver/-/work_items/87 | [email protected] | gitlab.com | |
| gitlab.com/hmailserver/hmailserver/-/releases/v6.3.7 | [email protected] | gitlab.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Found in the hMailServer project's own security review (Progressive Robot Ltd) (en)
Additional Advisory Data
Solutions
CNA: Upgrade to hMailServer 6.3.7, in which the one authorization rule answers administer_server only for a grant that reaches every domain, so an account assigned serveradmin with a list of domains is confined to the domains the list names, holding serveradmin's permissions in them short of what reaches beyond a domain and none in any other: over COM it is refused the server settings, a domain alias, a domain's name and the other changes that reach beyond a domain, exactly as over the REST API, where the same rule answers the check, and it is a domain administrator of its own account's domain where the list names that domain; it reaches the other domains its list names through REST, and over COM through the calls that name a domain of their own, among them the password reset, the unlock, the mailbox move and its history, the message trace, role assignment and a message's sender (send-as). An account assigned domainadmin with a list of domains likewise administers its own account's domain over COM only where the list names that domain. A grant with no list of domains is unchanged. Until then, do not assign the serveradmin role with a list of domains to a credential that must be confined: assign a custom role holding only the permissions it needs, with the list of domains, or the domainadmin role with a list of domains that names the account's own domain.