---
id: "CVE-2026-107566"
kind: "vulnerability"
aliases: ["CVE-2026-107566"]
title: "hMailServer: Sieve and mail rules let users send mail as any address"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["dkim", "dmarc", "email", "hmailserver", "package", "self-hosted"]
not_affected_if: ["default-config", "no-sieve-or-mail-rules"]
published_at: "2026-10-19T16:17:01+00:00"
first_seen_at: "2026-10-23T21:57:18+00:00"
updated_at: "2026-10-25T03:55:56+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107566", "first_seen_at": "2026-10-23T21:57:18+00:00"}]
---

# hMailServer: Sieve and mail rules let users send mail as any address

An authenticated hMailServer user can use a Sieve editheader action or a mail-rule Set header value action to rewrite From, Sender, Resent-From, Resent-Sender or DKIM-Signature before forwarding or copying a message. The server then sends the mail in that forged name and may DKIM-sign it with a hosted domain's key, so the forgery passes DMARC.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the hMailServer version with the admin tool or the installed package; affected releases are `6.2.22` through `6.3.6` for Sieve editheader and `6.0.0` through `6.3.6` for mail-rule Set header value.
- Review Sieve scripts and mail rules that use editheader or Set header value for header changes to From, Sender, Resent-From, Resent-Sender or DKIM-Signature.
- Confirm whether the server has DKIM signing enabled for hosted domains.

## Fix

- Upgrade hMailServer to a release later than `6.3.6`; the sources do not name the exact fixed version.
- Until patched, remove or disable Sieve editheader and mail-rule Set header value actions for sender-identity headers.
- Restrict who can create rules and scripts, and review existing forward or copy rules.

## Timeline

- 2026-10-23T21:57:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107566

## From the sources

Missing authorization in the Sieve editheader action (6.2.22 through 6.3.6) and in the mail-rule Set header value action (6.0.0 through 6.3.6) of Progressive Robot hMailServer allows an authenticated user to make the server send mail as any address, DKIM-signed where the address is at a domain the server signs for. A Sieve script's editheader (addheader/deleteheader) could add or delete any header field except Received and Return-Path, and the server applies a script's header edits before it queues a redirect, so the redirected copy is sent as the script left it. The server signs a message's first delivery pass as the domain named in its From header wherever it signs DKIM for that domain and the message carries no signature of it. A script could therefore delete and re-add From - another account's address, or anyone's at a hosted domain - and redirect, so the server sent the message in that name and, for a hosted domain, signed it with that domain's DKIM key, a forgery aligned to pass the domain's DMARC; or, where another sender's domain is one the server signs for, delete the DKIM-Signature that sender's message arrived with, alter a field, and redirect, so the server re-signed the altered message as that sender's domain. editheader placed no restriction on From, Sender, Resent-From, Resent-Sender or DKIM-Signature. The editheader action was introduced in 6.2.22. In the mail-rule engine, a domain's or an account's rule's Set header value action could likewise set From, Sender, Resent-From, Resent-Sender or DKIM-Signature ahead of a forward or a copy, whoever the rule belonged to, so that an account acting on its own rules over COM, a domain administrator, or an API key confined to a domain (over the REST API from 6.3.4) could have the server forward or copy a message in the name of any address, signed, where that address is at a domain the server hosts with DKIM signing enabled, with that domain's key.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_