Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-114474— Use of Less Trusted Source in hMailServer

Quick assessment

Affected
Progressive Robot Ltd hMailServer
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Progressive Robot hMailServer 6.0.0 至 6.3.6 版本中，外部账户邮件下载功能使用了可信度较低的信封发件人来源，这使得远程未认证攻击者能够伪造由该服务器托管的域名的发件人身份，并让服务器以该域名为信封发件人发送邮件，从而在接收方处通过 SPF 和 DMARC 验证。 具体而言，从外部 POP3 或 IMAP 账户下载的邮件本身没有独立的 SMTP 信封，而该服务器会直接将其“发件人（From）”头部的地址用作信封发件人，无论该地址为何。当此类邮件被转发或重定向到外部地址时，

CVSS 5.9 · Medium

Affected Version Matrix 1

VendorProduct Version RangeStatus
Progressive Robot Ltd hMailServer 6.0.0≤ 6.3.6 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-114474

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Use of Less Trusted Source in hMailServer
Source: CVE Program / CVE List V5
Vulnerability Description
Use of a less trusted source for the envelope sender in the external-account download of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have mail they write in the name of a domain the server hosts sent on by the server with an envelope sender at that domain, so that it passes the domain's SPF and DMARC at other receivers. A message the server downloads from an external POP3 or IMAP account has no SMTP envelope of its own, and the server took the address in its From header as its envelope sender, whatever that address was. A forward or redirect of the downloaded message to an outside address then left with that address as its envelope sender, which the Sender Rewriting Scheme leaves alone for a hosted domain, so that the receiver's SPF check passed for the forged domain, aligned even under strict alignment, with no non-default setting, host name record or DMARC policy needed. An attacker needs to know a mailbox elsewhere that an account here collects and forwards to an outside address; an account holder who adds an external account of their own can collect from a server of their own, which matters where SmtpAuthenticatedSenderCheck holds signed-in senders to their own addresses.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用不可信的源
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Progressive Robot Ltd hMailServer 6.0.0 ~ 6.3.6 -

II. Public POCs for CVE-2026-114474

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-114474

请登录查看更多情报信息。

Vendor Pages for CVE-2026-114474 (1)

Other References for CVE-2026-114474 (1)

Same Patch Batch · Progressive Robot Ltd · 2026-10-21 · 12 CVEs total

CVE-2026-114489 8.1 HIGH Missing Authorization in hMailServer
CVE-2026-114490 7.8 HIGH Incorrect Authorization in hMailServer
CVE-2026-114476 7.5 HIGH Incorrect Authorization in hMailServer
CVE-2026-114475 6.5 MEDIUM Missing Authorization in hMailServer
CVE-2026-114478 5.9 MEDIUM Unintended Proxy or Intermediary ('Confused Deputy') in hMailServer
CVE-2026-114479 5.8 MEDIUM Not Failing Securely ('Failing Open') in hMailServer
CVE-2026-114470 5.3 MEDIUM Cross-Site Request Forgery (CSRF) in hMailServer
CVE-2026-114473 5.0 MEDIUM Incorrect Authorization in hMailServer
CVE-2026-114471 4.7 MEDIUM Insertion of Sensitive Information into Log File in hMailServer
CVE-2026-114477 4.3 MEDIUM Missing Authorization in hMailServer
CVE-2026-114472 3.7 LOW Insufficient Resource Pool in hMailServer

IV. Related Vulnerabilities

Same product: hMailServer
Same vendor: Progressive Robot Ltd
Same weakness: CWE-348

V. Comments for CVE-2026-114474

No comments yet

Leave a comment