Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-114476— Incorrect Authorization in hMailServer

Quick assessment

Affected
Progressive Robot Ltd hMailServer
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Progressive Robot hMailServer 6.3.4 至 6.3.6 版本的 REST 管理 API 存在授权缺陷。该漏洞允许已认证的远程用户，若其凭据具备以下任一条件： 在指定域中拥有 manage_roles 权限； 持有针对这些域的全范围 API 密钥； 或被分配了 serveradmin 角色并关联特定域列表； 则能够获取服务器管理员（server administrator）的权限。 在 hMailServer 中，账户的“管理级别”（admin level）决定其权限范围；而为其分配的

CVSS 7.5 · High

Possible ATT&CK Techniques 2 AI

T1551.003 T1068.003

Affected Version Matrix 1

VendorProduct Version RangeStatus
Progressive Robot Ltd hMailServer 6.3.4≤ 6.3.6 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-114476

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Incorrect Authorization in hMailServer
Source: CVE Program / CVE List V5
Vulnerability Description
Incorrect authorization in the REST administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows a remote authenticated user whose credential holds the manage_roles permission in named domains - a full-scope API key issued for those domains, or an account assigned the serveradmin role with a list of domains - to obtain the server administrator's authority. An account's admin level gives it authority, and a role assigned to it replaces that authority, which is how an administrator narrows an account whose admin level is the server administrator's. The route that takes a role away (DELETE /api/v1/role-assignments/{address}) checked only that the credential takes in what the account held at the time, not what it would hold afterwards, so such a credential could take a narrowing role away from an account in its domains whose admin level is the server administrator's, returning it to the server administrator's authority, and, having set that account's password while it held the narrower role, sign in as the server administrator.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Progressive Robot Ltd hMailServer 6.3.4 ~ 6.3.6 -

II. Public POCs for CVE-2026-114476

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-114476

请登录查看更多情报信息。

Vendor Pages for CVE-2026-114476 (1)

Other References for CVE-2026-114476 (1)

Same Patch Batch · Progressive Robot Ltd · 2026-10-21 · 12 CVEs total

CVE-2026-114489 8.1 HIGH Missing Authorization in hMailServer
CVE-2026-114490 7.8 HIGH Incorrect Authorization in hMailServer
CVE-2026-114475 6.5 MEDIUM Missing Authorization in hMailServer
CVE-2026-114478 5.9 MEDIUM Unintended Proxy or Intermediary ('Confused Deputy') in hMailServer
CVE-2026-114474 5.9 MEDIUM Use of Less Trusted Source in hMailServer
CVE-2026-114479 5.8 MEDIUM Not Failing Securely ('Failing Open') in hMailServer
CVE-2026-114470 5.3 MEDIUM Cross-Site Request Forgery (CSRF) in hMailServer
CVE-2026-114473 5.0 MEDIUM Incorrect Authorization in hMailServer
CVE-2026-114471 4.7 MEDIUM Insertion of Sensitive Information into Log File in hMailServer
CVE-2026-114477 4.3 MEDIUM Missing Authorization in hMailServer
CVE-2026-114472 3.7 LOW Insufficient Resource Pool in hMailServer

IV. Related Vulnerabilities

Same product: hMailServer
Same vendor: Progressive Robot Ltd
Same weakness: CWE-863

V. Comments for CVE-2026-114476

No comments yet

Leave a comment