Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-114473— Incorrect Authorization in hMailServer

Quick assessment

Affected
Progressive Robot Ltd hMailServer
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Progressive Robot hMailServer 6.2.1 至 6.3.6 版本中，发件人重写方案（Sender Rewriting Scheme，SRS）存在授权缺陷，允许远程攻击者通过该服务器向外部地址中继邮件。当启用 SRS 时，服务器会将其转发的邮件的信封发件人重写为转发域名下的已签名 SRS 地址，并将退回邮件发送至该地址以返回给原始发件人。然而，该实现将任何发往有效 SRS 地址的邮件（无论其发件人是谁）均视为投递给本地收件人，因此未应用中继控制规则及所需的 SMTP 身份验证，导致邮件被直

CVSS 5.0 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-114473

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Incorrect Authorization in hMailServer
Source: CVE Program / CVE List V5
Vulnerability Description
Incorrect authorization in the Sender Rewriting Scheme (SRS) of Progressive Robot hMailServer 6.2.1 through 6.3.6 allows a remote attacker to relay mail through the server to outside addresses. With SRS enabled, the server rewrites the envelope sender of mail it forwards to a signed SRS address at the forwarding domain, and passes a bounce to that address back to the original sender; but it took every message to a valid SRS address, whatever its sender, as delivery to a local recipient, so the relay rules and the SMTP authentication they require were not applied, and the message was delivered to the outside address the SRS address encodes. Anyone holding a valid SRS address of the server, such as the recipient of a forwarded message, could have the server relay mail to the address it encodes for 21 days, and an account holder whose account forwards to an outside mailbox could obtain one for any address. SRS is off by default.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Progressive Robot Ltd hMailServer 6.2.1 ~ 6.3.6 -

II. Public POCs for CVE-2026-114473

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-114473

请登录查看更多情报信息。

Vendor Pages for CVE-2026-114473 (1)

Other References for CVE-2026-114473 (1)

Same Patch Batch · Progressive Robot Ltd · 2026-10-21 · 12 CVEs total

CVE-2026-114489 8.1 HIGH Missing Authorization in hMailServer
CVE-2026-114490 7.8 HIGH Incorrect Authorization in hMailServer
CVE-2026-114476 7.5 HIGH Incorrect Authorization in hMailServer
CVE-2026-114475 6.5 MEDIUM Missing Authorization in hMailServer
CVE-2026-114478 5.9 MEDIUM Unintended Proxy or Intermediary ('Confused Deputy') in hMailServer
CVE-2026-114474 5.9 MEDIUM Use of Less Trusted Source in hMailServer
CVE-2026-114479 5.8 MEDIUM Not Failing Securely ('Failing Open') in hMailServer
CVE-2026-114470 5.3 MEDIUM Cross-Site Request Forgery (CSRF) in hMailServer
CVE-2026-114471 4.7 MEDIUM Insertion of Sensitive Information into Log File in hMailServer
CVE-2026-114477 4.3 MEDIUM Missing Authorization in hMailServer
CVE-2026-114472 3.7 LOW Insufficient Resource Pool in hMailServer

IV. Related Vulnerabilities

Same product: hMailServer
Same vendor: Progressive Robot Ltd
Same weakness: CWE-863

V. Comments for CVE-2026-114473

No comments yet

Leave a comment