CVE-2026-114476: Incorrect Authorization in hMailServer
Incorrect authorization in the REST administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows a remote authenticated user whose credential holds the manageroles permission in named domains - a full-scope API key issued for those domains, or an account assigned the serveradmin role with a list of domains - to obtain the server administrator's authority. An account's admin level gives it authority, and a role assigned to it replaces that authority, which is how an administrator narrows an account whose admin level is the server administrator's. The route that takes a role away (DELETE /api/v1/role-assignments/{address}) checked only that the credential takes in what the account held at the time, not what it would hold afterwards, so such a credential could take a narrowing role away from an account in its domains whose admin level is the server administrator's, returning it to the server administrator's authority, and, having set that account's password while it held the narrower role, sign in as the server administrator.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progressive Robot hMailServerto a version that resolves this vulnerability.Fixed in 6.3.7 - Configuration
Give an account whose admin level is the server administrator's a role that narrows its authority to the level intended by that role.
hMailServer account role assignments admin level = the authority intended by the assigned role - Compensating control
Do not issue a full-scope API key or assign the serveradmin role, even when confined to named domains, to a party that is not trusted with the whole server.
- Operational
Review role assignments and accounts whose admin level is the server administrator's after upgrading, because upgrading does not restore a role that was already taken away.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Progressive Robot hMailServer versions 6.3.4 through 6.3.6 are affected when the REST administration API has an account with server-administrator admin level that is constrained by a role assignment, and the relevant domains are accessible to a credential with manage_roles permission.
What access does an attacker need?
The attacker must already be remotely authenticated with either a full-scope API key for the affected named domains that has manage_roles permission, or an account assigned the serveradmin role with a list of those domains. Exploitation also depends on finding a server-administrator-level account in those domains whose authority has been narrowed by an assigned role.
How does exploitation lead to server-administrator access?
The attacker can delete the narrowing role assignment through DELETE /api/v1/role-assignments/{address}. This restores the target account's server-administrator authority; if the attacker set that account's password while its narrower role was active, they can then sign in using that account.
What version resolves the issue?
The referenced release is hMailServer v6.3.7. The affected range stated for this issue ends at 6.3.6.