CVE-2026-114475: CWE-862: Missing Authorization in Progressive Robot Ltd hMailServer

The vulnerability arises because the REST role-management routes in hMailServer do not properly enforce authorization checks for credentials confined to named domains. Although only the serveradmin role should have the manage_roles permission required to create, update, or delete custom roles, a full-scope API key or serveradmin role limited to certain domains can access these routes without restriction. This flaw enables a confined credential to alter custom roles assigned to other tenants, potentially granting or removing permissions across domains. The flaw does not permit assigning server-level administrative privileges through custom roles.

An attacker with authenticated access limited to certain domains can manipulate custom roles affecting other tenants, potentially granting excessive permissions or removing necessary permissions on mailboxes and settings in those domains. This could lead to unauthorized privilege escalation within affected domains but does not allow full server administration control. The integrity of role-based access control across tenants is compromised.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict API key issuance and serveradmin role assignments carefully to minimize cross-domain privilege risks. Monitor and audit role management activities for unauthorized changes.