CVE-2026-114475 Missing Authorization in hMailServer
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-114475?
CVE-2026-114475 is a medium-severity vulnerability in Progressive Robot Ltd hMailServer, published on 21 Oct 2026.
Official description
Missing authorization in the REST role-management routes of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows a remote authenticated user whose credential is confined to named domains to modify a custom role that accounts in other domains hold, and to create custom roles and delete any that no account holds. The routes that create, update and delete a custom role require the manage_roles permission, which only the serveradmin role holds; but a full-scope API key issued for named domains, and serveradmin assigned with a domain list, are serveradmin confined to those domains and hold manage_roles. The server's authorization gate did not refuse the three role routes to a confined credential and the route named no domain, so a credential issued to one tenant could raise or lower the permissions of a custom role assigned across other tenants - granting another domain's role every permission over its mailboxes and settings, or removing what it needs. A custom role may not hold administer_server, administer_domain or manage_roles, so the confined credential cannot make itself or another a server administrator by creating or rewriting a custom role.
Weakness: CWE-862
Which versions are affected by CVE-2026-114475?
How do I fix CVE-2026-114475?
No fix has been published for CVE-2026-114475 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-114475 being exploited?
There is no known exploitation of CVE-2026-114475 in the wild and no public exploit code.
Sources
Also known as GHSA-83f6-27vp-q455.