Medium · CVSS 5.0CVE-2026-114473

Incorrect Authorization in hMailServerCVE-2026-114473

Answer in brief

CVE-2026-114473 records a Medium severity (CVSS 5.0) vulnerability in Incorrect Authorization in hMailServer. The current sources do not mark it as known exploited. The current feed maps Progressive Robot Ltd/hMailServer (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Oct 21, 2026Updated Oct 21, 2026Source checked Oct 21, 2026First seen by HOL Oct 21, 2026Material review Oct 21, 2026

Upstream Advisory

Key facts

Risk: Medium · CVSS 5.0
Exploitation: Not marked as known exploited
Affected software: 1 mapped package or product
Fix availability: Not reported

Why this deserves its current priority

CVSS is 5.0. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps Progressive Robot Ltd/hMailServer (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
Progressive Robot Ltd/hMailServergeneric	>=6.2.1 <=6.3.6	Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for Progressive Robot Ltd/hMailServer.
Review the reported fix. Source-reported solution: Upgrade to hMailServer 6.3.7, which takes only a bounce (a null reverse-path) to an SRS address as local delivery and holds any other message to it to the relay rules: where they refuse it, the transaction is refused at DATA or BDAT, and a recipient named after such an address in the same transaction is answered 452 4.5.3. Until then, turn SRS off (SRSEnabled=0, the default).

Evidence timeline and material changes

Published upstream
Oct 21, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Oct 21, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Oct 21, 2026

Sources and claim methodology

Upstream source description

Incorrect authorization in the Sender Rewriting Scheme (SRS) of Progressive Robot hMailServer 6.2.1 through 6.3.6 allows a remote attacker to relay mail through the server to outside addresses. With SRS enabled, the server rewrites the envelope sender of mail it forwards to a signed SRS address at the forwarding domain, and passes a bounce to that address back to the original sender; but it took every message to a valid SRS address, whatever its sender, as delivery to a local recipient, so the relay rules and the SMTP authentication they require were not applied, and the message was delivered to the outside address the SRS address encodes. Anyone holding a valid SRS address of the server, such as the recipient of a forwarded message, could have the server relay mail to the address it encodes for 21 days, and an account holder whose account forwards to an outside mailbox could obtain one for any address. SRS is off by default.

Quoted source text, attributed separately from HOL analysis.

Incorrect Authorization in hMailServerSame progressive robot ltd/hmailserver package