Authorization Flaw in hMailServer by Progressive Robot
CVE-2026-114476

7.5HIGH

Key Information:

Vendor

Progressive Robot Ltd

Status
Hmailserver
Vendor
CVE Published:
21 October 2026

What is CVE-2026-114476?

An authorization issue in the REST administration API of hMailServer versions 6.3.4 to 6.3.6 permits remote authenticated users with manage_roles permission to gain unauthorized server administrator privileges. This occurs when an account with a narrowed role can inadvertently escalate privileges, allowing the attacker to assume control of the server administrator's authority. The vulnerability arises due to inadequate checks when modifying role assignments, potentially jeopardizing the overall security of the server and its management capabilities.

Affected Version(s)

hMailServer 6.3.4 <= 6.3.6

References

https://gitlab.com/hmailserver/hmailserver/-/work_items/88
https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.7

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Found in the hMailServer project's own security review (Progressive Robot Ltd)
.