CVE-2026-114477: CWE-862: Missing Authorization in Progressive Robot Ltd hMailServer

This vulnerability (CVE-2026-114477) in hMailServer affects versions 6.2.25 through 6.3.6. The REST API endpoint GET /api/v1/metrics/history returns server-wide traffic counters for the last 30 days. Normally, users with credentials confined to named domains are restricted from accessing server-wide counters and can only view metrics for their domains. However, due to missing authorization checks on this metrics route, such users—including domain administrators, auditors with view_configuration permissions, or API keys scoped to named domains—can retrieve aggregate traffic data for the entire server. The disclosed information is limited to aggregate counters and does not include message content or account-specific data.

An authenticated user with domain-confined credentials can access aggregate server-wide traffic metrics that should be restricted to domain-specific data. This exposure could reveal operational details about the mail server's overall traffic patterns but does not disclose message content, account information, or allow modification of data. The impact is limited to information disclosure of aggregate counters.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the REST metrics API to fully authorized users only or disable the metrics route if possible to prevent unauthorized aggregate data disclosure.