CVE-2026-107566: CWE-862: Missing Authorization in Progressive Robot Ltd hMailServer

This vulnerability involves missing authorization checks in the Sieve editheader action (introduced in version 6.2.22) and the mail-rule Set header value action in hMailServer versions 6.0.0 through 6.3.6. Authenticated users can add, delete, or modify email headers such as From, Sender, Resent-From, Resent-Sender, and DKIM-Signature before the server queues a redirect or forward. Because the server applies DKIM signatures based on the From header domain, attackers can forge emails that appear to originate from any address within a domain the server signs for, including valid DKIM signatures, effectively bypassing DMARC protections. This flaw allows an attacker with authenticated access to send emails impersonating other users or domains hosted on the server.

The vulnerability allows an authenticated user with at least low privileges to send forged emails that appear to come from any address within a domain the server signs for, including valid DKIM signatures. This undermines email integrity and trust, enabling potential phishing, spoofing, or impersonation attacks that can bypass DMARC protections. There is no impact on confidentiality or availability reported, but the integrity of email sending is compromised.

No explicit patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user permissions to trusted users only and monitor for suspicious use of mail rules or Sieve scripts that modify headers. Avoid enabling DKIM signing for domains unless necessary and consider disabling or restricting the use of the editheader and Set header value actions if possible.