CVE-2026-114489: CWE-862: Missing Authorization in Progressive Robot Ltd hMailServer

This vulnerability (CWE-862) in hMailServer 6.0.0 through 6.3.6 allows remote authenticated users with credentials confined to specific domains to escalate their privileges and modify mail routing and domain configurations outside their authorized domains. The REST and COM administration APIs lack proper authorization enforcement, enabling domain administrators or API keys scoped to named domains to create domain aliases, rename domains, and alter mail routing rules affecting other tenants on a multi-tenant server. Specifically, the COM API permits account-level users to modify rule actions that execute scripts during mail delivery without adequate authorization checks. These flaws permit unauthorized mail diversion, denial, and manipulation of server routing and relay settings.

An attacker with authenticated access limited to certain domains can escalate privileges to affect mail routing and domain configurations for other tenants on the same server. This can lead to mail interception, diversion, denial of service for mail delivery, and unauthorized execution of scripts during mail processing. The confidentiality and integrity of mail for multiple tenants on a shared server are at risk. The vulnerability does not affect availability directly but compromises mail delivery and security.

No official patch or fix is currently confirmed for this vulnerability. Users should monitor the vendor's advisory for updates and apply any official fixes once available. Until then, restrict access to the REST and COM administration APIs to trusted users only and consider isolating tenants to prevent cross-domain privilege escalation. Avoid granting domain administrators or API keys broader privileges than necessary. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.