Authorization Flaw in Progressive Robot hMailServer

CVE-2026-114475

What is CVE-2026-114475?

An authorization flaw exists in the role-management routes of Progressive Robot hMailServer versions 6.3.4 to 6.3.6. This vulnerability enables a remote authenticated user with restricted domain credentials to alter the permissions of custom roles associated with other domains. Specifically, it allows modifications to roles that should be tightly governed, enabling unauthorized changes that can lead to elevated permissions across different tenants. The issue stems from the inadequate enforcement of role permissions within the server's API, which failed to prevent confined credentials from accessing essential role management functionalities. Notably, while users cannot directly escalate privileges to server administrator roles, they can create and delete custom roles, posing a risk to the overall security posture of the server.

References