CVE-2026-114489 Progressive Robot Ltd CVE debrief

Who should care

Defenders responsible for hMailServer deployments, particularly those with multi-tenant configurations, should assess exposure and prioritize remediation. This includes reviewing current configurations, verifying API access, and applying patches. Additionally, security teams managing hMailServer should evaluate the potential impact on their systems and implement compensating controls where necessary. Operators of hMailServer should also consider the need

Why it matters

Defenders should prioritize verifying and restricting API access, reviewing mail routing and domain configurations, and applying vendor-provided patches to prevent potential unauthorized changes and service disruptions.

• Potential unauthorized changes to mail routing and domain configurations
• Possible diversion of mail or denial of service
• Need for verification of API access and mail configurations
• Priority for applying vendor-provided patches

Technical summary

The vulnerability allows remote authenticated users with confined credentials to change mail routing and domain configuration beyond their assigned domains in Progressive Robot hMailServer. This is due to missing authorization in the REST and COM administration APIs. Affected versions include hMailServer 6.0.0 through 6.3.6. The vulnerability could allow a domain administrator or an account with API key given another role that manages accounts in named domains to create a domain alias, rename a domain, modify mail routing, and set the domain's relay host. This could potentially divert mail or deny service. The issue arises from the authorization gate not refusing these routes to a confined credential.

Defensive priority

Defenders should prioritize verifying and restricting API access, reviewing mail routing and domain configurations, and applying vendor-provided patches.

Recommended defensive actions

• Verify and restrict access to hMailServer APIs
• Review mail routing and domain configurations for potential unauthorized changes
• Apply vendor-provided patches to affected versions
• Monitor for suspicious activity and implement compensating controls
• Perform vulnerability assessment to identify exposed systems
• Implement asset inventory to track hMailServer deployments
• Review and update incident response plans for potential service disruptions

Evidence notes

The CVE record and source item provide details on the vulnerability, affected versions, and potential impacts. However, additional verification is needed to confirm the full scope of affected systems and remediation steps.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.