Incorrect Authorization in Progressive Robot hMailServer

CVE-2026-114490

What is CVE-2026-114490?

An authorization flaw in the COM administration API of hMailServer versions 6.3.4 through 6.3.6 allows an account with the serveradmin role to function as a full server administrator. This occurs even when the account is restricted to specific domains, posing a significant security risk. The API mishandles permission checks, enabling unauthorized access to all accounts and settings across the server. As a result, an attacker could manipulate domain accounts, alter server configurations, and escalate privileges through the COM API. Accounts without a list of domains remain unaffected, but those given broad permissions could exploit this vulnerability.

References