CVE-2026-114476: CWE-863: Incorrect Authorization in Progressive Robot Ltd hMailServer

This vulnerability (CWE-863) exists in the REST administration API of hMailServer versions 6.3.4 to 6.3.6. The flaw is in the DELETE /api/v1/role-assignments/{address} endpoint, which checks authorization based on the current role of the credential holder but fails to verify the resulting permissions after removing a narrowing role from an account. This allows an authenticated user with manage_roles permission scoped to certain domains or with the serveradmin role assigned to domain lists to remove a narrowing role from an account that has server administrator level privileges, effectively restoring full server administrator authority. The attacker can then reset the password of that account and sign in as the server administrator, gaining full control.

An authenticated user with limited administrative permissions can escalate their privileges to full server administrator authority on the affected hMailServer instances. This leads to complete compromise of the mail server, including the ability to reset passwords and access all administrative functions, potentially impacting confidentiality, integrity, and availability of the mail server and its data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the REST administration API to trusted users only and carefully audit roles and permissions assigned to users. Monitor for suspicious role assignment changes and consider disabling or limiting the use of the affected API endpoint if possible.