hMailServer: Missing authorization in REST and COM administration APIs
Summary
hMailServer 6.0.0 through 6.3.6 does not refuse certain mail routing and domain configuration changes to a credential that is confined to named domains. A remote authenticated user with such a credential, for example a domain administrator or a named-domain API key, can create domain aliases for arbitrary names, rename domains, set rule actions that reach the server's own addresses, routes, credentials or event script functions, and point the domain's relay host at the server's internal network. On multi-tenant servers this can divert or deny other tenants' mail; over the COM API, any account can set these rule actions on its own rules.
Affected
- hMailServer 6.0.0 through 6.3.6 (Windows and Linux builds from 6.3.0)
- REST API affected from 6.3.0 to 6.3.6 for the listed routes; COM API affected from 6.0.0
Fixed in
- Upgrade to hMailServer 6.3.7 (released 17 October 2026)
Workaround
- Do not grant domain administrator credentials, roles managing accounts in named domains, or named-domain API keys to parties not trusted with the whole server
- Keep the REST API disabled (RestApiPort=0, the default) where it is not needed
- Review existing domain aliases, domain names, relay hosts and rule actions for unexpected entries
Exploitation
- No known exploitation in the wild; not listed in CISA KEV
- CISA SSVC: exploitation none, automatable no, technical impact total
- No public proof of concept found
- Exploitation requires a valid credential confined to specific domains
Our recommendation
- Upgrade all hMailServer installations to 6.3.7 or later
- Until patched, limit who holds domain-scoped credentials and disable the REST API if unused
- Audit domain aliases, domain names, relay hosts and rule actions for unexpected entries
- Confirm the fix against the vendor advisory and work item #86 before closing the ticket
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- hMailServer 6.3.7 release (GitLab) gitlab.com
- Work item #86 (GitLab) gitlab.com
- OSV: CVE-2026-114489 osv.dev
- VulDB 424875 vuldb.com
- Hol.org CVE-2026-114489 advisory hol.org
- hMailServer 6.3.7 release (GitHub mirror) github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 18:10.
Original description (NVD)
Missing authorization in the REST and COM administration APIs of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote authenticated user whose credential is confined to named domains to change mail routing and domain configuration beyond those domains on a multi-tenant server. A domain administrator, an account or API key given another role that manages accounts in named domains, or a full-scope API key issued for named domains could create a domain alias for any name (so that other tenants' mail for that name is diverted to an address the attacker controls, or denied), rename a domain to any name the server does not host, set a rule's bind-to-address, send-using-route or script-function action to reach one of the server's own addresses, a configured route's stored credentials or a function of the server's event script, and set the domain's relay host - which delivery then connects to with no address rule - to an address on the server's own network; and over the COM API any account could set the three rule actions on its own rules, where the script-function action runs at delivery. The authorization gate did not refuse these routes to a confined credential and the handlers were not given the caller; over COM the domain-alias save performed no authorization check at all, the domain rename required only a domain administrator, and a rule save required at most that the caller could change the rule's owner.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.