Authorization Flaw in Progressive Robot hMailServer Affects Email Sending Functionality
CVE-2026-107568

6.5MEDIUM

Key Information:

Vendor

Progressive Robot Ltd

Status
Hmailserver
Vendor
CVE Published:
19 October 2026

What is CVE-2026-107568?

An authorization flaw in Progressive Robot hMailServer enables an authenticated user to misleadingly send emails from any sender address. This loophole primarily affects the Sieve notify action and the mail-rule Reply action across multiple versions, permitting an attacker to manipulate the From header without proper validation. This flaw can lead to the delivery of unauthorized notifications and responses, especially when combined with DKIM signing, allowing attackers to leverage trusted domains for deceptive purposes. The vulnerability was introduced with version 6.2.22 and remains unpatched in later versions up to 6.3.6.

Affected Version(s)

hMailServer 6.0.0 <= 6.3.6

References

https://gitlab.com/hmailserver/hmailserver/-/work_items/82
https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.7

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Found in the hMailServer project's own security review (Progressive Robot Ltd)
.