High · CVSS 7.8CVE-2026-114490

Incorrect Authorization in hMailServerCVE-2026-114490

Answer in brief

CVE-2026-114490 records a High severity (CVSS 7.8) vulnerability in Incorrect Authorization in hMailServer. The current sources do not mark it as known exploited. The current feed maps Progressive Robot Ltd/hMailServer (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Oct 21, 2026Updated Oct 21, 2026Source checked Oct 21, 2026First seen by HOL Oct 21, 2026Material review Oct 21, 2026

Upstream Advisory

Key facts

Risk: High · CVSS 7.8
Exploitation: Not marked as known exploited
Affected software: 1 mapped package or product
Fix availability: Not reported

Why this deserves its current priority

CVSS is 7.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps Progressive Robot Ltd/hMailServer (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
Progressive Robot Ltd/hMailServergeneric	>=6.3.4 <=6.3.6	Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for Progressive Robot Ltd/hMailServer.
Review the reported fix. Source-reported solution: Upgrade to hMailServer 6.3.7, in which the one authorization rule answers administer_server only for a grant that reaches every domain, so an account assigned serveradmin with a list of domains is confined to the domains the list names, holding serveradmin's permissions in them short of what reaches beyond a domain and none in any other: over COM it is refused the server settings, a domain alias, a domain's name and the other changes that reach beyond a domain, exactly as over the REST API, where the same rule answers the check, and it is a domain administrator of its own account's domain where the list names that domain; it reaches the other domains its list names through REST, and over COM through the calls that name a domain of their own, among them the password reset, the unlock, the mailbox move and its history, the message trace, role assignment and a message's sender (send-as). An account assigned domainadmin with a list of domains likewise administers its own account's domain over COM only where the list names that domain. A grant with no list of domains is unchanged. Until then, do not assign the serveradmin role with a list of domains to a credential that must be confined: assign a custom role holding only the permissions it needs, with the list of domains, or the domainadmin role with a list of domains that names the account's own domain.

Evidence timeline and material changes

Published upstream
Oct 21, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Oct 21, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Oct 21, 2026

Sources and claim methodology

Upstream source description

Incorrect authorization in the COM administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows an account assigned the serveradmin role with a list of domains - a credential an administrator may create meaning to confine it to those domains - to act as the whole-server administrator over COM. Administrator roles are meant to confine such a credential to the domains its list names, and the REST API did not take it for the server administrator, but the COM API's server-administrator check read the administer_server permission as the whole server whatever list the grant carried. So the credential signed in through the Control Panel, or through a script run on the server, as the server administrator of every domain: it could read and change every domain's accounts and mail, rename any domain, map a domain alias onto any, write the server's settings and secrets, and create further server-administrator accounts. The COM API's domain-administrator check, asked with no domain, likewise let an account assigned the domainadmin role with a list of domains that leaves out the account's own domain administer that domain's ordinary accounts over COM. An account holding serveradmin with no list is the server administrator by design and is unaffected, as are the help desk, auditor and custom roles.

Quoted source text, attributed separately from HOL analysis.