Missing Authorization in hMailServer

Summary

Missing authorization in the REST role-management routes of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows a remote authenticated user whose credential is confined to named domains to modify a custom role that accounts in other domains hold, and to create custom roles and delete any that no account holds. The routes that create, update and delete a custom role require the manage_roles permission, which only the serveradmin role holds; but a full-scope API key issued for named domains, and serveradmin assigned with a domain list, are serveradmin confined to those domains and hold manage_roles. The server's authorization gate did not refuse the three role routes to a confined credential and the route named no domain, so a credential issued to one tenant could raise or lower the permissions of a custom role assigned across other tenants - granting another domain's role every permission over its mailboxes and settings, or removing what it needs. A custom role may not hold administer_server, administer_domain or manage_roles, so the confined credential cannot make itself or another a server administrator by creating or rewriting a custom role.

Timeline

1. Oct 21, 2026, 3:12 PM UTCCVE published
2. Oct 22, 2026, 9:34 PM UTCFirst seen by cve.now
3. Oct 29, 2026, 5:33 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

4. Oct 29, 2026, 8:56 PM UTCRecord last updated

Affected versions

• Progressive Robot Ltd hMailServer

  From 6.3.4 · through 6.3.6

References 2