Authorization Flaw in hMailServer Allows Email Spoofing
CVE-2026-107566
6.5MEDIUM
What is CVE-2026-107566?
A vulnerability in hMailServer versions 6.2.22 to 6.3.6 allows an authenticated user to manipulate email headers through the Sieve editheader action and mail-rule Set header value action. This flaw facilitates the unauthorized sending of emails as any address, exploiting the server's ability to sign messages with DKIM for hosted domains. Attackers can modify the From, Sender, and DKIM-Signature fields, circumventing existing security measures and potentially harming the integrity of email communications.
Affected Version(s)
hMailServer 6.0.0 <= 6.3.6
References
CVSS V3.1
Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Found in the hMailServer project's own security review (Progressive Robot Ltd)