CVE-2026-114477 Progressive Robot Ltd CVE debrief

Who should care

Defenders responsible for hMailServer installations, particularly those with multi-domain configurations, should assess their exposure and verify access controls. Domain administrators and users with confined credentials should be aware of the potential for unauthorized access to server-wide traffic history.

Why it matters

This vulnerability allows remote authenticated users with confined credentials to read server-wide traffic history, potentially exposing aggregate operational counters. Defenders should prioritize verifying and restricting access to the metrics route.

• Potential unauthorized access to server-wide traffic history by users with confined credentials
• Possible exposure of aggregate operational counters, including server-wide traffic totals

Technical summary

The vulnerability is caused by missing authorization in the REST metrics route of hMailServer, allowing remote authenticated users with confined credentials to read server-wide traffic history. This issue affects hMailServer versions 6.2.25 through 6.3.6. The vulnerability allows users with domain-limited credentials, such as domain administrators or those with the auditor role, to access server-wide traffic counters for the last 30 days, which they should not be able to view. Defenders should prioritize verifying and restricting access to the metrics route, ensuring that users with confined credentials can only view their own domain's traffic history.

Defensive priority

Defenders should prioritize verifying and restricting access to the metrics route, ensuring that users with confined credentials can only view their own domain's traffic history. This may involve updating access controls or reviewing user roles and permissions.

Recommended defensive actions

• Verify and restrict access to the metrics route
• Review user roles and permissions to ensure confined credentials are properly limited
• Update access controls to prevent unauthorized access to server-wide traffic history
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and references to additional information. However, there is limited information on the actual impact or exploitation of this vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.