Cross-Site Request Forgery in hMailServer by Progressive Robot
CVE-2026-114470

5.3MEDIUM

Key Information:

Vendor

Progressive Robot Ltd

Status
Hmailserver
Vendor
CVE Published:
21 October 2026

What is CVE-2026-114470?

The hMailServer suffers from a cross-site request forgery vulnerability in its REST API, allowing remote attackers to send state-changing requests using the cached credentials of an authenticated user. This vulnerability arises as the REST API employs HTTP Basic authentication, which does not enforce necessary cross-site protection measures. An attacker can create a malicious webpage that, when visited by a user with active credentials, may exploit this weakness to execute unauthorized actions such as altering settings or creating accounts, without the user’s consent. This vulnerability underscores the importance of implementing robust cross-origin resource sharing practices to enhance API security.

Affected Version(s)

hMailServer 6.0.0 <= 6.3.6

References

https://gitlab.com/hmailserver/hmailserver/-/work_items/93
https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.7

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Found in the hMailServer project's own security review (Progressive Robot Ltd)
.