CVE-2026-114473: CWE-863: Incorrect Authorization in Progressive Robot Ltd hMailServer

The vulnerability in hMailServer's SRS feature arises from improper authorization checks. When SRS is enabled, the server rewrites the envelope sender to a signed SRS address and routes bounces accordingly. However, the server incorrectly accepts any message sent to a valid SRS address as local, skipping relay rules and SMTP authentication. This allows an attacker with a valid SRS address, such as a recipient of a forwarded message, to relay mail to the external address encoded in the SRS address for up to 21 days. An account holder with forwarding enabled can generate valid SRS addresses for arbitrary external addresses, facilitating unauthorized mail relay.

An attacker with access to a valid SRS address can relay mail through the vulnerable hMailServer instance to arbitrary external recipients without SMTP authentication. This can be abused to send unauthorized emails, potentially facilitating spam or phishing campaigns. The vulnerability does not impact confidentiality or availability but allows integrity impact via unauthorized mail relay. The CVSS score is 5.0 (medium severity).

No official patch or fix is currently documented. Since SRS is off by default, disabling SRS prevents exploitation. Administrators should verify if SRS is enabled and consider disabling it until a vendor fix is available. Monitor vendor advisories for updates or patches addressing this authorization flaw.