CVE-2026-107568— hMailServer 身份验证缺失漏洞
一分钟漏洞结论
影响对象
Progressive Robot Ltd hMailServer
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
Progressive Robot hMailServer 在 Sieve 通知动作（版本 6.2.22 至 6.3.6）以及邮件规则中的回复动作（版本 6.0.0 至 6.3.6）中存在授权缺失漏洞。该漏洞允许已认证用户通过服务器以任意邮箱地址发送邮件。 Sieve 通知动作会发送通知邮件，其 标签指定发件人；服务器在设置通知邮件的 From 头时，直接沿用脚本中写明的 值，而未验证该地址是否属于当前账户。相比之下，Sieve 度假（vacation）动作会对自身的 执行此类验证，且服务器会对通过 COM 接口入
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-107568 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Missing Authorization in hMailServer
来源: CVE Program / CVE List V5
Vulnerability Description
Missing authorization in the Sieve notify action (6.2.22 through 6.3.6) and in the mail-rule Reply action (6.0.0 through 6.3.6) of Progressive Robot hMailServer allows an authenticated user to send mail through the server as any address. A Sieve notify sends a notification message, and its :from tag names the sender; the server set the notification's From header to that :from as the script wrote it, without checking that the address belongs to the account - the check that the Sieve vacation action applies to its own :from, and that the server applies to the sender of mail queued over COM or sent from the webmail. An account that can store a Sieve script (over ManageSieve, the REST API's self-service filter, or the administration interface) could therefore have the server send a notification from any address, on this server or anywhere; and where the claimed address is at a domain the server hosts with DKIM signing enabled, the server signed the notification with that domain's DKIM key, because it signs by the From header's domain, producing forged mail aligned to pass the domain's DMARC policy. The notify action and this behaviour were introduced in 6.2.22. In the mail-rule engine, a rule's Reply was likewise sent from whatever address the action named, whoever the rule belonged to, so that an account acting on its own rules over COM, a domain administrator, or an API key confined to a domain (over the REST API from 6.3.4) could have a domain's or an account's rule reply from any address, signed, where that address is at a domain the server hosts with DKIM signing enabled, with that domain's key.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
来源: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
来源: CVE Program / CVE List V5
受影响产品
| 厂商 | 产品 | 影响版本 | CPE | 订阅 |
|---|---|---|---|---|
| Progressive Robot Ltd | hMailServer | 6.0.0 ~ 6.3.6 | - |
|
二、漏洞 CVE-2026-107568 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-107568 的情报信息
请登录查看更多情报信息。
CVE-2026-107568 其他参考 (2)
同批安全公告 · Progressive Robot Ltd · 2026-10-19 · 共 5 条
| CVE-2026-107571 | 7.8 HIGH | hMailServer 默认权限配置不当漏洞 |
| CVE-2026-107567 | 7.5 HIGH | hMailServer 使用低信任源漏洞 |
| CVE-2026-107569 | 7.5 HIGH | hMailServer 循环条件未检查输入漏洞 |
| CVE-2026-107566 | 6.5 MEDIUM | hMailServer 认证缺失漏洞 |
IV. Related Vulnerabilities
V. Comments for CVE-2026-107568
暂无评论