CVE-2026-114474: Use of Less Trusted Source in hMailServer
Use of a less trusted source for the envelope sender in the external-account download of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have mail they write in the name of a domain the server hosts sent on by the server with an envelope sender at that domain, so that it passes the domain's SPF and DMARC at other receivers. A message the server downloads from an external POP3 or IMAP account has no SMTP envelope of its own, and the server took the address in its From header as its envelope sender, whatever that address was. A forward or redirect of the downloaded message to an outside address then left with that address as its envelope sender, which the Sender Rewriting Scheme leaves alone for a hosted domain, so that the receiver's SPF check passed for the forged domain, aligned even under strict alignment, with no non-default setting, host name record or DMARC policy needed. An attacker needs to know a mailbox elsewhere that an account here collects and forwards to an outside address; an account holder who adds an external account of their own can collect from a server of their own, which matters where SmtpAuthenticatedSenderCheck holds signed-in senders to their own addresses.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progressive Robot hMailServerto a version that resolves this vulnerability.Fixed in 6.3.7 - Compensating control
Until hMailServer 6.3.7 is installed, do not forward or redirect to an outside address mail from an account that collects an external mailbox when the message's From header can name a domain hosted by the server.
Event History
Frequently Asked Questions
Which deployments are affected?
Progressive Robot hMailServer versions 6.0.0 through 6.3.6 are affected. The issue concerns external-account download workflows that retrieve mail from external POP3 or IMAP accounts and then forward or redirect it to an outside address.
What must an attacker know or control to exploit this?
An attacker needs to know a mailbox at another provider that an hMailServer account collects and forwards to an external address. An account holder who can add an external account can collect mail from a server they control.
Is a non-default configuration or DNS/DMARC setup required?
No. The described behavior occurs without a non-default setting, host name record, or DMARC policy.
How can an administrator identify potentially exposed accounts?
Review hMailServer accounts configured with external POP3 or IMAP collection and forwarding or redirection to addresses outside the server. Those combinations can cause downloaded messages to leave with the address in the message From header used as the envelope sender.