Threats Tagged 'cve-2026-114470'

CVE-2026-114470 is a Cross-Site Request Forgery (CSRF) vulnerability in the REST API of Progressive Robot Ltd's hMailServer versions 6.0.0 through 6.3.6. It allows a remote attacker to cause an authenticated user's browser to perform state-changing actions without their consent. The vulnerability arises because the REST API uses HTTP Basic authentication, which browsers cache and send automatically with requests, including cross-origin form submissions. The server does not enforce CSRF protections on HTTP Basic authentication, enabling blind forgery of actions such as creating domains, accounts, or API keys by an attacker controlling a malicious webpage visited by an authenticated user. The attacker cannot read the responses to these forged requests.