---
id: CVE-2026-114475
title: Missing Authorization in hMailServer
summary: >-
  Missing authorization in the REST role-management routes of Progressive Robot
  hMailServer 6.3.4 through 6.3.6 allows a remote authenticated user whose
  credential is confined to named domains to modify a custom role that accounts
  in other…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-862
vendor: Progressive Robot Ltd
product: hMailServer
affected:
  - hMailServer >= 6.3.4 <= 6.3.6
published: '2026-10-21'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T15:12:20.842Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-114475'
references:
  - url: 'https://gitlab.com/hmailserver/hmailserver/-/work_items/89'
  - url: 'https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.7'
tags:
  - cve.org
ingestedAt: '2026-10-21T16:05:17.707Z'
---

## Overview

Missing authorization in the REST role-management routes of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows a remote authenticated user whose credential is confined to named domains to modify a custom role that accounts in other domains hold, and to create custom roles and delete any that no account holds. The routes that create, update and delete a custom role require the manage_roles permission, which only the serveradmin role holds; but a full-scope API key issued for named domains, and serveradmin assigned with a domain list, are serveradmin confined to those domains and hold manage_roles. The server's authorization gate did not refuse the three role routes to a confined credential and the route named no domain, so a credential issued to one tenant could raise or lower the permissions of a custom role assigned across other tenants - granting another domain's role every permission over its mailboxes and settings, or removing what it needs. A custom role may not hold administer_server, administer_domain or manage_roles, so the confined credential cannot make itself or another a server administrator by creating or rewriting a custom role.

## Affected

- `hMailServer >= 6.3.4 <= 6.3.6`

## Remediation

Upgrade to hMailServer 6.3.7, whose authorization gate refuses the create, update and delete role routes to a credential confined to named domains, while leaving the read of roles unchanged. Until then, on a multi-tenant server, do not issue a full-scope API key - or assign serveradmin - confined to named domains to a party not trusted with the whole server; keep the REST API off (RestApiPort=0, the default) where it is not needed; and review custom roles' permissions for changes a confined credential should not have made (after upgrading as well, since an upgrade does not undo a change already made).