CVE-2026-114475— Missing Authorization in hMailServer
Quick assessment
Affected
Progressive Robot Ltd hMailServer
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Progressive Robot hMailServer 6.3.4 至 6.3.6 版本中，REST 角色管理路由存在授权缺失漏洞。该漏洞允许已远程认证且凭据仅限特定命名域的用户，修改其他域账户所持有的自定义角色，并创建自定义角色或删除任何未被任何账户持有的角色。 创建、更新和删除自定义角色的路由需要 权限，该权限仅由 角色拥有。然而，为特定命名域签发的全作用域 API 密钥，以及被分配了域列表的 ，其权限会被限制在这些域内，但仍持有 权限。由于服务器的授权机制未拒绝受限凭据对这三个角色路由的访问，也未拒绝对“
Possible ATT&CK Techniques 3 AI
T1068 · Exploitation for Privilege Escalation T1548 · Abuse Elevation Control Mechanism T1548.003 · Sudo and Sudo CachingAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Progressive Robot Ltd | hMailServer | 6.3.4≤ 6.3.6 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-114475
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Missing Authorization in hMailServer
Source: CVE Program / CVE List V5
Vulnerability Description
Missing authorization in the REST role-management routes of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows a remote authenticated user whose credential is confined to named domains to modify a custom role that accounts in other domains hold, and to create custom roles and delete any that no account holds. The routes that create, update and delete a custom role require the manage_roles permission, which only the serveradmin role holds; but a full-scope API key issued for named domains, and serveradmin assigned with a domain list, are serveradmin confined to those domains and hold manage_roles. The server's authorization gate did not refuse the three role routes to a confined credential and the route named no domain, so a credential issued to one tenant could raise or lower the permissions of a custom role assigned across other tenants - granting another domain's role every permission over its mailboxes and settings, or removing what it needs. A custom role may not hold administer_server, administer_domain or manage_roles, so the confined credential cannot make itself or another a server administrator by creating or rewriting a custom role.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Progressive Robot Ltd | hMailServer | 6.3.4 ~ 6.3.6 | - |
|
II. Public POCs for CVE-2026-114475
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-114475
请登录查看更多情报信息。
Vendor Pages for CVE-2026-114475 (1)
Other References for CVE-2026-114475 (1)
Same Patch Batch · Progressive Robot Ltd · 2026-10-21 · 12 CVEs total
| CVE-2026-114489 | 8.1 HIGH | Missing Authorization in hMailServer |
| CVE-2026-114490 | 7.8 HIGH | Incorrect Authorization in hMailServer |
| CVE-2026-114476 | 7.5 HIGH | Incorrect Authorization in hMailServer |
| CVE-2026-114478 | 5.9 MEDIUM | Unintended Proxy or Intermediary ('Confused Deputy') in hMailServer |
| CVE-2026-114474 | 5.9 MEDIUM | Use of Less Trusted Source in hMailServer |
| CVE-2026-114479 | 5.8 MEDIUM | Not Failing Securely ('Failing Open') in hMailServer |
| CVE-2026-114470 | 5.3 MEDIUM | Cross-Site Request Forgery (CSRF) in hMailServer |
| CVE-2026-114473 | 5.0 MEDIUM | Incorrect Authorization in hMailServer |
| CVE-2026-114471 | 4.7 MEDIUM | Insertion of Sensitive Information into Log File in hMailServer |
| CVE-2026-114477 | 4.3 MEDIUM | Missing Authorization in hMailServer |
| CVE-2026-114472 | 3.7 LOW | Insufficient Resource Pool in hMailServer |
IV. Related Vulnerabilities
Same product: hMailServer
-
CVE-2026-114490
Incorrect Authorization in hMailServer -
CVE-2026-114489
Missing Authorization in hMailServer -
CVE-2026-114479
Not Failing Securely ('Failing Open') in hMailServer -
CVE-2026-114478
Unintended Proxy or Intermediary ('Confused Deputy') in hMai -
CVE-2026-114477
Missing Authorization in hMailServer
Same vendor: Progressive Robot Ltd
-
CVE-2026-114490
Incorrect Authorization in hMailServer -
CVE-2026-114489
Missing Authorization in hMailServer -
CVE-2026-114479
Not Failing Securely ('Failing Open') in hMailServer -
CVE-2026-114478
Unintended Proxy or Intermediary ('Confused Deputy') in hMai -
CVE-2026-114477
Missing Authorization in hMailServer
Same weakness: CWE-862
-
CVE-2026-114135
Jupyter Server: Gateway WebSocket handler bypasses kernel ex -
CVE-2026-114267
SourceCodester Food Order Management System Admin Endpoint a -
CVE-2026-19947
Missing kernel object permission check in devmux syscalls al -
CVE-2026-105937
Apache Pulsar: Missing authorization of the shadow topic sou -
CVE-2026-105936
Apache Pulsar: Functions connectors list endpoint does not a
V. Comments for CVE-2026-114475
No comments yet