CVE-2026-107568 Missing Authorization in hMailServer
Authenticated users can forge email headers and DKIM signatures via Sieve or mail rules, enabling spoofed emails that bypass DMARC checks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-107568?
CVE-2026-107568 is a medium-severity missing authorization vulnerability in Progressive Robot Ltd hMailServer, published on 19 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Missing authorization in the Sieve notify action (6.2.22 through 6.3.6) and in the mail-rule Reply action (6.0.0 through 6.3.6) of Progressive Robot hMailServer allows an authenticated user to send mail through the server as any address. A Sieve notify sends a notification message, and its :from tag names the sender; the server set the notification's From header to that :from as the script wrote it, without checking that the address belongs to the account - the check that the Sieve vacation action applies to its own :from, and that the server applies to the sender of mail queued over COM or sent from the webmail. An account that can store a Sieve script (over ManageSieve, the REST API's self-service filter, or the administration interface) could therefore have the server send a notification from any address, on this server or anywhere; and where the claimed address is at a domain the server hosts with DKIM signing enabled, the server signed the notification with that domain's DKIM key, because it signs by the From header's domain, producing forged mail aligned to pass the domain's DMARC policy. The notify action and this behaviour were introduced in 6.2.22. In the mail-rule engine, a rule's Reply was likewise sent from whatever address the action named, whoever the rule belonged to, so that an account acting on its own rules over COM, a domain administrator, or an API key confined to a domain (over the REST API from 6.3.4) could have a domain's or an account's rule reply from any address, signed, where that address is at a domain the server hosts with DKIM signing enabled, with that domain's key.
Weakness: CWE-862
Which versions are affected by CVE-2026-107568?
How do I fix CVE-2026-107568?
No fix has been published for CVE-2026-107568 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-107568 being exploited?
There is no known exploitation of CVE-2026-107568 in the wild and no public exploit code.
Sources
Also known as GHSA-625v-xcvx-8hhv.