CVE-2026-114478: CWE-441: Unintended Proxy or Intermediary ('Confused Deputy') in Progressive Robot Ltd hMailServer

CVE-2026-114478 describes a 'Confused Deputy' vulnerability (CWE-441) in Progressive Robot Ltd's hMailServer versions 6.0.0 through 6.3.6. The issue arises from insufficient preservation of the original sender information when forwarding mail. When the server forwards mail from outside sources via account forwards, mail rules, Sieve redirects, lists, aliases, or list expansions to external addresses, it may assign the forwarded copy an SMTP identity aligned with the hosted domain's From address. This occurs if Sender Rewriting Scheme (SRS) or envelope sender rewriting is enabled, or under certain conditions involving bounce addresses or SPF-authorized subdomains. As a result, SPF and DMARC checks at receiving servers may pass for the forwarded mail, even though the original message did not pass DMARC. Exploitation requires a forwarding mechanism carrying mail to outside addresses and specific server configurations. A related DKIM-based issue is tracked as CVE-2026-107567.

An attacker can send mail that appears to originate legitimately from the hosted domain by exploiting forwarding and rewriting behaviors, causing receiving mail servers to pass SPF and DMARC validation incorrectly. This undermines the domain's email authentication policies and can facilitate phishing or spoofing attacks. The vulnerability requires no authentication but depends on specific forwarding configurations and server settings. There is no indication of direct confidentiality or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should review forwarding configurations and the use of Sender Rewriting Scheme or envelope sender rewriting features. Disabling these features if not required may reduce risk. Monitor vendor communications for official patches or updates addressing this issue.