Authorization Flaw in Progressive Robot hMailServer Leading to Unrestricted Mail Relay
CVE-2026-114473

5MEDIUM

Key Information:

Vendor

Progressive Robot Ltd

Status
Hmailserver
Vendor
CVE Published:
21 October 2026

What is CVE-2026-114473?

An authorization flaw in Progressive Robot hMailServer versions 6.2.1 to 6.3.6 enables remote attackers to exploit the Sender Rewriting Scheme (SRS). The vulnerability allows them to relay emails through the server to external addresses without proper authentication. This happens despite SRS being off by default, as the server fails to apply relay rules and SMTP authentication when rewriting email addresses. As a result, any user holding a valid SRS address can route messages to any address encoded by the SRS for up to 21 days. This vulnerability poses substantial risks to email integrity and security, especially for those users with accounts configured to forward emails to outside mailboxes.

Affected Version(s)

hMailServer 6.2.1 <= 6.3.6

References

https://gitlab.com/hmailserver/hmailserver/-/work_items/94
https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.7

CVSS V3.1

Score:
5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Upstream hMailServer, whose public pull request 649 fixed the same flaw in its own SRS code; found and fixed in this fork by the hMailServer project's triage of it (Progressive Robot Ltd)
.