CVE-2026-114470: Cross-Site Request Forgery (CSRF) in hMailServer
Cross-site request forgery in the REST API of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote attacker to make an authenticated user's browser perform a state-changing request. The REST API accepts HTTP Basic authentication and answers a browser with a Basic sign-in box; a browser caches the credential once the box is answered and sends it with later requests to that origin, including a top-level form post from another site, and the server reads a request body whatever its declared content type. The cross-site protection covered only the cookie session (a header a cross-site form cannot set, and a SameSite=Strict cookie); HTTP Basic was not held to it. A page under an attacker's control, visited by a user whose browser holds a cached Basic credential for the REST API - typically an administrator who signed in through the box - could therefore cause a state-changing request such as creating a domain, an account or an API key, or changing a setting, with the victim's credential. The attacker cannot read the cross-origin response, so the forgery is blind.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
hMailServerto a version that resolves this vulnerability.Fixed in 6.3.7 - Configuration
Keep the REST API off by setting RestApiPort=0 (the default), or bind it to loopback when it is needed.
hMailServer REST API RestApiPort = 0 - Compensating control
Access the REST API and the Deck from a dedicated browser or profile that is closed after use, so no cached Basic credential is present while browsing other sites.
- Compensating control
Prefer an API key using a Bearer token over the HTTP Basic authentication sign-in box for automated clients.
- Operational
Review API keys, accounts, domains, and settings for unauthorized changes, and revoke any API key nobody issued.
Event History
Frequently Asked Questions
Which users are exposed to a cross-site request attempt?
Users whose browsers have cached HTTP Basic credentials for the hMailServer REST API are exposed, typically administrators who previously authenticated through the browser’s Basic sign-in prompt. An attacker must induce such a user to visit an attacker-controlled page.
Does the attacker need to know an administrator password or read the API response?
No. The attacker can rely on the browser automatically sending its cached Basic credential during a top-level cross-site form submission. The attack is blind: the attacker cannot read the cross-origin response.
What actions could a successful request perform?
A successful forgery can perform state-changing REST API operations using the victim’s permissions, such as creating a domain, account, or API key, or changing a setting.
Are cookie-authenticated REST API sessions affected in the same way?
The described cross-site protection applied to cookie sessions through a required header and a SameSite=Strict cookie. The exposed authentication path is HTTP Basic authentication, which was not subject to that protection.
Which versions need remediation?
Progressive Robot hMailServer versions 6.0.0 through 6.3.6 are identified as affected. The provided references include the v6.3.7 release.