{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-107568 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2026-107568 yet. Limit exposure of the affected software until one is available.","what":"CVE-2026-107568 is a medium-severity missing authorization vulnerability in Progressive Robot Ltd hMailServer, published on 19 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-107568 and fix it if it is affected.\n\nWhat it is: CVE-2026-107568 is a medium-severity missing authorization vulnerability in Progressive Robot Ltd hMailServer, published on 19 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-107568 in the wild and no public exploit code.\n\nAffected product: Progressive Robot Ltd hMailServer. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-107568/ (Markdown: https://insights.sbomify.com/CVE-2026-107568/index.md)","id":"CVE-2026-107568","markdown":"https://insights.sbomify.com/CVE-2026-107568/index.md","name":"CVE-2026-107568","record":{"aliases":["GHSA-625v-xcvx-8hhv"],"analysis":{"component_type":"server_software","fix_type":"patch","impacts":["data_modify","security_bypass"],"network_reachable":"yes","non_default_config":false,"product_category":"hMailServer mail server","requires_auth":"low_privilege","summary":"Authenticated users can forge email headers and DKIM signatures via Sieve or mail rules, enabling spoofed emails that bypass DMARC checks.","user_interaction":"not_required","vuln_class":"missing_authorization"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitLab","cpe":[],"cvss":{"score":6.5,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"cwes":[{"id":"CWE-862","name":"Missing Authorization"}],"description":"Missing authorization in the Sieve notify action (6.2.22 through 6.3.6) and in the mail-rule Reply action (6.0.0 through 6.3.6) of Progressive Robot hMailServer allows an authenticated user to send mail through the server as any address. A Sieve notify sends a notification message, and its :from tag names the sender; the server set the notification's From header to that :from as the script wrote it, without checking that the address belongs to the account - the check that the Sieve vacation action applies to its own :from, and that the server applies to the sender of mail queued over COM or sent from the webmail. An account that can store a Sieve script (over ManageSieve, the REST API's self-service filter, or the administration interface) could therefore have the server send a notification from any address, on this server or anywhere; and where the claimed address is at a domain the server hosts with DKIM signing enabled, the server signed the notification with that domain's DKIM key, because it signs by the From header's domain, producing forged mail aligned to pass the domain's DMARC policy. The notify action and this behaviour were introduced in 6.2.22. In the mail-rule engine, a rule's Reply was likewise sent from whatever address the action named, whoever the rule belonged to, so that an account acting on its own rules over COM, a domain administrator, or an API key confined to a domain (over the REST API from 6.3.4) could have a domain's or an account's rule reply from any address, signed, where that address is at a domain the server hosts with DKIM signing enabled, with that domain's key.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":false,"headline":"Missing Authorization in hMailServer","id":"CVE-2026-107568","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"missing_authorization","year":"2026"},"n_packages":0,"n_references":2,"next":{"headline":"Unchecked Input for Loop Condition in hMailServer","id":"CVE-2026-107569"},"packages":[],"prev":{"headline":"Use of Less Trusted Source in hMailServer","id":"CVE-2026-107567"},"products":["hMailServer"],"published":"2026-10-19","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-10-20","vendors":["Progressive Robot Ltd"]},"summary":"Authenticated users can forge email headers and DKIM signatures via Sieve or mail rules, enabling spoofed emails that bypass DMARC checks.","url":"https://insights.sbomify.com/CVE-2026-107568/"}