CVE-2026-107568: CWE-862: Missing Authorization in Progressive Robot Ltd hMailServer
Description
CVE-2026-107568 is a missing authorization vulnerability in Progressive Robot Ltd's hMailServer affecting versions 6.0.0 through 6.3.6. It allows an authenticated user to send email through the server as any address via the Sieve notify action (introduced in 6.2.22) and the mail-rule Reply action. The server does not verify that the 'From' address in these actions belongs to the account, enabling forged emails that can be DKIM-signed and aligned with the domain's DMARC policy. This vulnerability has a CVSS 3.1 score of 6.5 (medium severity).
CVSS v3.1
Score 6.5medium
Affected software
Progressive Robot Ltd
hMailServer
pkg:github/hmailserver/hmailserverRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability arises from missing authorization checks in the Sieve notify action (versions 6.2.22 through 6.3.6) and the mail-rule Reply action (versions 6.0.0 through 6.3.6) in Progressive Robot Ltd's hMailServer. Authenticated users who can store Sieve scripts or manage mail rules can cause the server to send emails with arbitrary 'From' addresses without verifying ownership. This includes the ability to send notifications or replies from any address hosted on the server, which, if the domain uses DKIM signing, results in forged emails that pass DKIM and DMARC validation. The vulnerability affects versions from 6.0.0 up to and including 6.3.6. There is no indication of known exploits in the wild or vendor-provided patches at this time.
Potential Impact
An authenticated user can send emails through the hMailServer as any address, including addresses at domains hosted by the server with DKIM signing enabled. This can lead to forged emails that pass DKIM and DMARC checks, potentially enabling phishing or spoofing attacks that appear legitimate to recipients. The vulnerability does not impact confidentiality or availability but has a high impact on integrity.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to accounts that can upload Sieve scripts or manage mail rules to trusted users only. Monitor for unusual email sending patterns and consider disabling the Sieve notify and mail-rule Reply actions if feasible.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitLab
- Date Reserved
- 2026-10-08T10:51:05.636Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ad63bfb2cdf04f65667d8a6
Added to database: 10/19/2026, 15:49:15 UTC
Last enriched: 10/19/2026, 16:04:04 UTC
Last updated: 10/19/2026, 19:06:47 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.