CVE-2026-114475 Progressive Robot Ltd CVE debrief

Who should care

Defenders responsible for hMailServer installations, particularly those with multi-domain setups, should assess exposure and verify remediation. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Defenders should prioritize verifying and remediating this vulnerability in hMailServer 6.3.4 through 6.3.6.

Why it matters

CVE-2026-114475 is a missing authorization vulnerability in hMailServer that allows a remote authenticated user to modify custom roles across domains, potentially leading to unauthorized role modifications and increased risk of mailbox and settings compromise. Defenders responsible for hMailServer installations, particularly those with multi-domain setups, should assess exposure and verify remediation.

• Potential unauthorized role modifications across domains
• Elevation of privileges for confined credentials
• Increased risk of mailbox and settings compromise

Technical summary

The REST role-management routes in hMailServer 6.3.4 through 6.3.6 lack authorization, allowing a remote authenticated user to modify custom roles across domains. This could lead to unauthorized role modifications and increased risk of mailbox and settings compromise. The server's authorization gate did not refuse the three role routes to a confined credential and the route named no domain, so a credential issued to one tenant could raise or lower the permissions of a custom role assigned across other tenants - granting another domain's role every permission over its mailboxes and settings, or removing what it needs.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in hMailServer 6.3.4 through 6.3.6.

Recommended defensive actions

• Verify hMailServer version and apply patches if necessary
• Review and restrict API keys and serveradmin roles
• Monitor for suspicious role modifications and API activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the missing authorization vulnerability in hMailServer. The vulnerability allows a remote authenticated user to modify custom roles across domains, potentially leading to unauthorized role modifications and increased risk of mailbox and settings compromise. Defenders should verify the affected scope, severity, and vendor guidance. The CVE record was published on 2026-10-21T15:12:20.842Z and has not been modified since then. There are supplemental source references available for patched

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.