CVE-2026-114474: CWE-348: Use of Less Trusted Source in Progressive Robot Ltd hMailServer

This vulnerability (CVE-2026-114474) in Progressive Robot Ltd hMailServer versions 6.0.0 through 6.3.6 is due to the server using the From header address as the envelope sender when downloading messages from external POP3 or IMAP accounts. Because these downloaded messages lack their own SMTP envelope, the server's use of the less trusted From header allows an attacker to craft emails that appear to originate from a domain hosted by the server. When such messages are forwarded or redirected externally, the envelope sender remains the forged domain address, causing SPF and DMARC checks at the recipient to pass, including under strict alignment policies. Exploitation requires knowledge of a mailbox that the server collects mail for and forwards externally. The vulnerability is tracked as CWE-348 (Use of Less Trusted Source).

An attacker can send emails that appear to originate legitimately from a domain hosted by the vulnerable hMailServer, bypassing SPF and DMARC protections at recipient mail servers. This can facilitate spoofing attacks, potentially enabling phishing or impersonation. The vulnerability does not allow direct compromise of the server or data but undermines email authentication mechanisms, impacting trust in email origin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should be cautious about adding external accounts that forward mail externally and consider monitoring or restricting such configurations. No vendor advisory or patch information is currently provided.