IT SBIT Services
Schneeberger
DEEN
CVE tracker

hMailServer: Incorrect authorization in COM administration API

CVE-2026-114490High 7.8

← All vulnerabilities

Summary

The COM administration API of hMailServer 6.3.4 to 6.3.6 does not restrict an account with the serveradmin role and a domain list to those domains. Such an account is treated as the server administrator of all domains. An account with the domainadmin role and a domain list that excludes its own domain can also administer the ordinary accounts of that domain over COM. An attacker holding such a valid credential, signing in through the Control Panel or a script on the server, can read and change all domains' accounts and mail, rename domains, add domain aliases, change server settings and create new server administrators.

Affected

  • hMailServer 6.3.4 through 6.3.6 (Windows, as the COM API is Windows only)
  • Accounts with serveradmin and a non-empty domain list
  • Accounts with domainadmin and a domain list that excludes their own domain
  • The vendor's CNA record gives this range; VulDB states 'up to 6.3.6', so older builds should also be checked

Fixed in

  • Upgrade to hMailServer 6.3.7

Workaround

  • Until 6.3.7 is installed, do not assign the serveradmin role with a domain list to a credential that must be confined to those domains.
  • Use a custom role with the required permissions and a domain list, or the domainadmin role with a domain list that includes the account's own domain.
  • Review role assignments in the Control Panel under Accounts & domains, Administrator roles, or via GET /api/v1/role-assignments.

Exploitation

  • No public exploit or in-the-wild exploitation known at the time of the sources.
  • CISA SSVC: exploitation none, not automatable, total technical impact.
  • Local access and a valid low-privilege administrator credential are required.

Our recommendation

  • Update to hMailServer 6.3.7.
  • Review all accounts with the serveradmin or domainadmin role that have a domain list, and remove or narrow grants that are not needed.
  • Restrict who may run COM scripts on the server.
  • Check the Control Panel and administration logs for unexpected server-administrator changes or new admin accounts.
  • If the REST API is exposed to the internet, also patch CVE-2026-114476, which is fixed in the same release.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 22:51.

Original description (NVD)

Incorrect authorization in the COM administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows an account assigned the serveradmin role with a list of domains - a credential an administrator may create meaning to confine it to those domains - to act as the whole-server administrator over COM. Administrator roles are meant to confine such a credential to the domains its list names, and the REST API did not take it for the server administrator, but the COM API's server-administrator check read the administer_server permission as the whole server whatever list the grant carried. So the credential signed in through the Control Panel, or through a script run on the server, as the server administrator of every domain: it could read and change every domain's accounts and mail, rename any domain, map a domain alias onto any, write the server's settings and secrets, and create further server-administrator accounts. The COM API's domain-administrator check, asked with no domain, likewise let an account assigned the domainadmin role with a list of domains that leaves out the account's own domain administer that domain's ordinary accounts over COM. An account holding serveradmin with no list is the server administrator by design and is unaffected, as are the help desk, auditor and custom roles.

NVD references (2)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed