Key points
- CVE-2026-114489 affects hMailServer versions 6.0.0 through 6.3.6.
- The National Vulnerability Database rates the flaw as high severity with a CVSS score of 8.1.
- The source material does not mention a vendor patch or fix.
Administrators running Progressive Robot hMailServer must identify systems using versions 6.0.0 through 6.3.6 immediately. The National Vulnerability Database lists CVE-2026-114489 as a high-severity issue. The flaw allows authenticated users with limited permissions to modify mail routing and domain configurations across the entire server. This is particularly dangerous on multi-tenant setups where different organizations share the same mail infrastructure.
In plain English
The software fails to check if a user has permission to change certain settings. A user who can only manage their own domain can use the REST or COM administration APIs to change settings for other domains. They can create aliases that divert email meant for other tenants to an address they control. They can also rename domains or change rules so that delivery connects to specific internal addresses.
The background
The weakness stems from missing authorization checks in the API handlers. When a user saves domain aliases via the COM API, the system performs no authorization check at all. For domain renames, it only requires the user to be a domain administrator. Rule saves only verify that the caller can change the rule's owner. These gaps allow credentials confined to named domains to execute actions that affect the whole server.
What changes now
The source material does not state that a fix exists. Teams must assess their exposure based on the current vulnerability. The flaw impacts both REST and COM interfaces. Any account, API key, or role that manages accounts in named domains could potentially exploit this. The ability to set relay hosts to internal addresses means an attacker could direct traffic to sensitive internal services. Organizations should review which accounts have API access and what roles they hold.
Who needs to act first
Teams usually prioritize systems exposed to the internet or accessible by multiple untrusted tenants. Check whether your hMailServer instance serves multiple independent domains. If so, treat this as urgent. Back up configuration files before making any changes to test environments. Roll out monitoring rules that alert on sudden changes to domain aliases, relay hosts, or rule actions. Reduce the number of active API keys and limit their scopes where possible.
What to do and how to stay safe: hMailServer
- Audit all API keys and user roles to identify accounts with domain management permissions.
- Monitor server logs for unexpected changes to domain aliases, relay hosts, or mail routing rules.
- Restrict network access to the hMailServer administration ports if possible.
- Review internal network segmentation to limit access from mail servers to other services.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of hMailServer are vulnerable to CVE-2026-114489?
Versions 6.0.0 through 6.3.6 are affected by this missing authorization flaw.
Can an attacker divert email to their own address?
Yes, they can create domain aliases that divert mail for other tenants to an address they control.
Does the source material mention a patch for this vulnerability?
No, the source material does not mention a patch or fix.
