CVE-2026-114477: Missing Authorization in hMailServer
Missing authorization in the REST metrics route of Progressive Robot hMailServer 6.2.25 through 6.3.6 allows a remote authenticated user whose credential is confined to named domains to read the server-wide traffic history. GET /api/v1/metrics/history returns the server's traffic counters over the last 30 days; those counters are server-wide and carry no domain, which is why the report routes already refuse the same counters to a credential confined to named domains. The metrics route was not among the routes the server's authorization gate refuses a confined credential and its handler was not given the caller, so a domain administrator, an account given another role that holds viewconfiguration in named domains (the auditor role given a domain list among them), or an API key issued for named domains could read the whole server's traffic totals rather than its own domains'. The disclosure is of aggregate operational counters, not of any message or account.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progressive Robot hMailServerto a version that resolves this vulnerability.Fixed in 6.3.7 - Configuration
Keep the REST API off by setting RestApiPort=0 where it is not needed.
hMailServer REST API RestApiPort = 0 - Compensating control
On a multi-tenant server, do not give a domain-administrator credential, a role that may read configuration in named domains, or a named-domain API key that may read configuration to anyone not trusted with server-wide traffic figures.
Event History
Frequently Asked Questions
Which users or credentials can access the server-wide traffic history?
A domain administrator, a role with view_configuration in named domains such as an auditor assigned a domain list, or an API key issued for named domains can read it. The issue affects credentials that are intended to be confined to specific domains.
What does an attacker need to exploit this issue?
The attacker needs remote access and valid authentication using a credential restricted to named domains. They can then request GET /api/v1/metrics/history without user interaction.
What information is exposed?
The endpoint returns server-wide traffic counters for the previous 30 days. The exposed data is aggregate operational traffic information and does not include message contents or account data.
Which versions are affected, and is a fix available?
Progressive Robot hMailServer versions 6.2.25 through 6.3.6 are affected. The provided release reference identifies version 6.3.7 as the subsequent release.