CVE-2026-114470: CWE-352: Cross-Site Request Forgery (CSRF) in Progressive Robot Ltd hMailServer

This vulnerability affects hMailServer versions 6.0.0 through 6.3.6. The REST API accepts HTTP Basic authentication, which browsers cache and send automatically with requests, including cross-origin form posts. The server's CSRF protections only cover cookie-based sessions and do not apply to HTTP Basic authentication. As a result, an attacker who can lure an authenticated user (typically an administrator) to a malicious webpage can cause the user's browser to send authenticated state-changing requests to the REST API. These requests can create or modify domains, accounts, API keys, or settings. The attack is blind because the attacker cannot read the cross-origin responses.

An attacker can perform unauthorized state-changing operations on the hMailServer REST API by exploiting the victim's authenticated session via HTTP Basic authentication. This can lead to unauthorized creation or modification of domains, accounts, API keys, or server settings. The attacker cannot view the responses, so the attack is blind, but the impact on integrity is high. There is no confidentiality or availability impact reported.

No official patch or fix is currently documented for this vulnerability. Users should check the vendor advisory for updates. In the meantime, administrators should avoid using HTTP Basic authentication for the REST API or restrict access to trusted networks. Implementing additional CSRF protections or using authentication methods that are not vulnerable to CSRF is recommended. Monitoring for suspicious state changes and limiting administrative access can help mitigate risk.