Missing Authorization in Progressive Robot hMailServer API

CVE-2026-114489

What is CVE-2026-114489?

The REST and COM administration APIs in Progressive Robot hMailServer versions 6.0.0 through 6.3.6 expose significant vulnerabilities due to missing authorization checks. These vulnerabilities can be exploited by remote authenticated users with confined credentials, allowing unauthorized changes to mail routing and domain configurations across the server. Malicious actors can create domain aliases, rename domains to arbitrary names, and alter routing rules to divert or manipulate email traffic in a multi-tenant environment, posing serious risks to data integrity and confidentiality. The lack of proper authorization mechanisms permits actions that should be restricted, facilitating an array of malicious activities that compromise tenant isolation and security.

References