Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-114478— Unintended Proxy or Intermediary ('Confused Deputy') in hMailServer

Quick assessment

Affected
Progressive Robot Ltd hMailServer
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Progressive Robot hMailServer 6.0.0 至 6.3.6 版本在邮件转发过程中未能充分保留原始发件人信息，使得远程未认证攻击者能够伪造邮件，将其"From"字段设置为该服务器所托管域内的地址，并成功通过接收方对该域的 DMARC 策略验证。 当服务器转发来自外部的邮件副本时（例如：账户转发、邮件规则转发、Sieve 重定向、邮件列表副本，或别名/列表扩展至外部地址），它可能为该副本赋予一个 SMTP 身份，该身份属于"From"字段所指向域的所属组织，而无论该邮件的实际来源如何。具体行

CVSS 5.9 · Medium

Affected Version Matrix 1

VendorProduct Version RangeStatus
Progressive Robot Ltd hMailServer 6.0.0≤ 6.3.6 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-114478

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Unintended Proxy or Intermediary ('Confused Deputy') in hMailServer
Source: CVE Program / CVE List V5
Vulnerability Description
Insufficient preservation of the original sender in the forwarding of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have mail they write, naming in its From an address at a domain the server hosts, delivered to other receivers as passing that domain's DMARC policy. When the server sent on a copy of mail that came from outside - an account's forward, a mail rule's forward, a Sieve redirect, a list's copy, or an alias or list expanding to an outside address - it could give the copy an SMTP identity in the organisation of the domain the copy's From names, whatever the message's origin: with the Sender Rewriting Scheme or the rewrite of the envelope sender on forwarding enabled (both off by default), an address at the forwarding domain; for a list, its bounce address; for a message with an empty envelope sender, none, under the server's own host name; and an envelope sender the message came with at a subdomain of a hosted domain was kept. Where that identity's SPF record authorises the server, other receivers' SPF check of the copy passed for a domain aligned with the From, and DMARC passed with it, although the message had not passed DMARC when the server received it. Exploitation needs a forward, redirect, alias or list that carries the hosted domain's mail to an outside address, and one of: SRS or the envelope rewrite enabled; a list whose bounce address is in the domain's organisation; an envelope sender at a subdomain whose SPF record authorises the server; or, for an empty envelope sender, an SPF record that authorises the server under its host name. The DKIM route to the same result is CVE-2026-107567.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
未有动机的代理或中间人(混淆代理)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Progressive Robot Ltd hMailServer 6.0.0 ~ 6.3.6 -

II. Public POCs for CVE-2026-114478

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-114478

请登录查看更多情报信息。

Vendor Pages for CVE-2026-114478 (2)

Same Patch Batch · Progressive Robot Ltd · 2026-10-21 · 12 CVEs total

CVE-2026-114489 8.1 HIGH Missing Authorization in hMailServer
CVE-2026-114490 7.8 HIGH Incorrect Authorization in hMailServer
CVE-2026-114476 7.5 HIGH Incorrect Authorization in hMailServer
CVE-2026-114475 6.5 MEDIUM Missing Authorization in hMailServer
CVE-2026-114474 5.9 MEDIUM Use of Less Trusted Source in hMailServer
CVE-2026-114479 5.8 MEDIUM Not Failing Securely ('Failing Open') in hMailServer
CVE-2026-114470 5.3 MEDIUM Cross-Site Request Forgery (CSRF) in hMailServer
CVE-2026-114473 5.0 MEDIUM Incorrect Authorization in hMailServer
CVE-2026-114471 4.7 MEDIUM Insertion of Sensitive Information into Log File in hMailServer
CVE-2026-114477 4.3 MEDIUM Missing Authorization in hMailServer
CVE-2026-114472 3.7 LOW Insufficient Resource Pool in hMailServer

IV. Related Vulnerabilities

Same product: hMailServer
Same vendor: Progressive Robot Ltd
Same weakness: CWE-441

V. Comments for CVE-2026-114478

No comments yet

Leave a comment