Missing Authorization in hMailServer

Summary

Missing authorization in the REST and COM administration APIs of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote authenticated user whose credential is confined to named domains to change mail routing and domain configuration beyond those domains on a multi-tenant server. A domain administrator, an account or API key given another role that manages accounts in named domains, or a full-scope API key issued for named domains could create a domain alias for any name (so that other tenants' mail for that name is diverted to an address the attacker controls, or denied), rename a domain to any name the server does not host, set a rule's bind-to-address, send-using-route or script-function action to reach one of the server's own addresses, a configured route's stored credentials or a function of the server's event script, and set the domain's relay host - which delivery then connects to with no address rule - to an address on the server's own network; and over the COM API any account could set the three rule actions on its own rules, where the script-function action runs at delivery. The authorization gate did not refuse these routes to a confined credential and the handlers were not given the caller; over COM the domain-alias save performed no authorization check at all, the domain rename required only a domain administrator, and a rule save required at most that the caller could change the rule's owner.

Timeline

1. Oct 21, 2026, 3:34 PM UTCCVE published
2. Oct 22, 2026, 9:34 PM UTCFirst seen by cve.now
3. Oct 29, 2026, 5:51 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

4. Oct 29, 2026, 8:55 PM UTCRecord last updated

Affected versions

• Progressive Robot Ltd hMailServer

  From 6.0.0 · through 6.3.6

References 2