CVE-2026-114490: Incorrect Authorization in hMailServer
Incorrect authorization in the COM administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows an account assigned the serveradmin role with a list of domains - a credential an administrator may create meaning to confine it to those domains - to act as the whole-server administrator over COM. Administrator roles are meant to confine such a credential to the domains its list names, and the REST API did not take it for the server administrator, but the COM API's server-administrator check read the administerserver permission as the whole server whatever list the grant carried. So the credential signed in through the Control Panel, or through a script run on the server, as the server administrator of every domain: it could read and change every domain's accounts and mail, rename any domain, map a domain alias onto any, write the server's settings and secrets, and create further server-administrator accounts. The COM API's domain-administrator check, asked with no domain, likewise let an account assigned the domainadmin role with a list of domains that leaves out the account's own domain administer that domain's ordinary accounts over COM. An account holding serveradmin with no list is the server administrator by design and is unaffected, as are the help desk, auditor and custom roles.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
hMailServerto a version that resolves this vulnerability.Fixed in 6.3.7 - Configuration
Until upgrading, avoid assigning the serveradmin role with a list of domains to credentials that must be confined. Assign a suitably limited custom role with the domain list, or assign domainadmin with a list naming the account's own domain.
hMailServer serveradmin role assignment with a domain list = Do not assign serveradmin with a list of domains; use a custom role containing only the required permissions with the domain list, or use domainadmin with a domain list that includes the account's own domain
Event History
Frequently Asked Questions
Which deployments are affected?
hMailServer versions 6.3.4 through 6.3.6 are affected. The issue applies to use of the COM administration API, including Control Panel access and scripts run on the server.
What access does an attacker need?
An attacker needs credentials for an account assigned the serveradmin role with a restricted domain list, or a domainadmin-role account whose assigned list excludes its own domain. No user interaction is required after the attacker has those credentials and can use the COM API.
What can a restricted administrator do through the vulnerable API?
A restricted serveradmin account can act as a whole-server administrator: it can access and modify all domains' accounts and mail, change domain names and aliases, alter server settings and secrets, and create additional server-administrator accounts. Affected domainadmin authorization can also allow administration of ordinary accounts in the account's own domain despite the assigned-domain list.
Is the REST API affected in the same way?
The provided information states that the REST API did not treat a serveradmin role with a restricted domain list as a whole-server administrator. The described authorization failures are in the COM administration API.
What version addresses the issue?
The referenced release is hMailServer v6.3.7. The affected range ends at 6.3.6.