Mail Server Vulnerability in Progressive Robot hMailServer by hMailServer
CVE-2026-114474

5.9MEDIUM

Key Information:

Vendor

Progressive Robot Ltd

Status
Hmailserver
Vendor
CVE Published:
21 October 2026

What is CVE-2026-114474?

The use of a less trusted source for the envelope sender in the external-account download functionality of Progressive Robot hMailServer versions 6.0.0 to 6.3.6 enables a remote unauthenticated attacker to send email messages impersonating a domain hosted by the server. When an external email is downloaded via POP3 or IMAP, the server incorrectly utilizes the From header as its envelope sender without validating its authenticity. Subsequently, if the downloaded message is forwarded to an outside address, it retains the forged envelope sender, allowing the message to bypass SPF and DMARC checks effectively, which could lead to unauthorized email transmission on behalf of legitimate domains. This vulnerability requires knowledge of an external mailbox that is being accessed and forwarded by the compromised account, highlighting a potential risk in poorly configured mail servers.

Affected Version(s)

hMailServer 6.0.0 <= 6.3.6

References

https://gitlab.com/hmailserver/hmailserver/-/work_items/91
https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.7

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Found in the hMailServer project's own security review (Progressive Robot Ltd)
.