CVE-2026-114476 Progressive Robot Ltd CVE debrief

Who should care

Defenders responsible for hMailServer installations, particularly those with manage_roles permission assigned to user accounts, should assess exposure and verify role assignments. Additionally, security teams and administrators responsible for managing user roles and permissions in hMailServer should be aware of this vulnerability and take necessary precautions to prevent exploitation. Operators and platform administrators should also review their systems

Why it matters

CVE-2026-114476 allows authenticated users to gain server administrator authority in hMailServer 6.3.4-6.3.6. Defenders should verify role assignments, ensure proper authorization checks, and monitor for suspicious activity.

• An authenticated user can gain server administrator authority
• Role assignments can be manipulated to escalate privileges
• Monitoring and verification of role assignments are necessary

Technical summary

The REST administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 has an incorrect authorization vulnerability. An authenticated user with manage_roles permission in named domains can obtain server administrator authority by manipulating role assignments. The vulnerability exists due to improper authorization checks in the API, specifically in the route that handles role assignments. This allows an attacker to escalate privileges and potentially gain unauthorized access to the affected system. Defenders should prioritize verifying and restricting role assignments, ensuring proper authorization checks, and monitoring for suspicious activity.

Defensive priority

Defenders should prioritize verifying and restricting role assignments, ensuring proper authorization checks, and monitoring for suspicious activity.

Recommended defensive actions

• Verify and restrict role assignments in hMailServer
• Ensure proper authorization checks are in place
• Monitor for suspicious activity related to role assignments
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, affected versions, and potential impact. However, additional information on exploitation or victim organizations is not available. The vulnerability is confirmed to exist in hMailServer versions 6.3.4 through 6.3.6. There is no evidence of public exploitation, but defenders should verify role assignments and ensure proper authorization checks to prevent potential attacks. The source item and CVE record provide limited information on the vulnerability, and further ver

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.