{"id":"CVE-2026-107568","kind":"vulnerability","aliases":["CVE-2026-107568"],"related":[],"title":"hMailServer: authenticated users can send mail as any address","description":"Missing authorization in the Sieve notify action (6.2.22 through 6.3.6) and in the mail-rule Reply action (6.0.0 through 6.3.6) of Progressive Robot hMailServer allows an authenticated user to send mail through the server as any address. A Sieve notify sends a notification message, and its :from tag names the sender; the server set the notification's From header to that :from as the script wrote it, without checking that the address belongs to the account - the check that the Sieve vacation action applies to its own :from, and that the server applies to the sender of mail queued over COM or sent from the webmail. An account that can store a Sieve script (over ManageSieve, the REST API's self-service filter, or the administration interface) could therefore have the server send a notification from any address, on this server or anywhere; and where the claimed address is at a domain the server hosts with DKIM signing enabled, the server signed the notification with that domain's DKIM key, because it signs by the From header's domain, producing forged mail aligned to pass the domain's DMARC policy. The notify action and this behaviour were introduced in 6.2.22. In the mail-rule engine, a rule's Reply was likewise sent from whatever address the action named, whoever the rule belonged to, so that an account acting on its own rules over COM, a domain administrator, or an API key confined to a domain (over the REST API from 6.3.4) could have a domain's or an account's rule reply from any address, signed, where that address is at a domain the server hosts with DKIM signing enabled, with that domain's key.","summary":"hMailServer's Sieve notify action and mail-rule Reply action set the sender address to whatever the script or rule named, without checking the account owns it. An authenticated user with a Sieve script or rule can make the server send mail as any address, signed with the domain's DKIM key where that domain is hosted.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dkim","email","hmailserver","package","self-hosted","sieve"],"not_affected_if":["managed-hosting","no-mail-rules","no-user-sieve-scripts"],"how_to_check":"- Check the installed hMailServer version; the notify action exists from `6.2.22` and the Reply rule action is affected from `6.0.0`.\n- Review Sieve scripts and mail rules that use notify or Reply actions for user-controlled From addresses.","fix":"- Upgrade hMailServer to a release later than `6.3.6` (fixed version unknown from the sources).\n- Until patched, restrict who can store Sieve scripts or create mail rules, and limit domain-confined API keys.","status":"open","published_at":"2026-10-19T16:17:01+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T03:55:55+00:00","updated_at":"2026-10-25T03:55:55+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T03:55:55Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade hMailServer to a release later than `6.3.6` (fixed version unknown from the sources).\n- Until patched, restrict who can store Sieve scripts or create mail rules, and limit domain-confined API keys.","reach":"network","title":"hMailServer: authenticated users can send mail as any address","impact":"medium","summary":"hMailServer's Sieve notify action and mail-rule Reply action set the sender address to whatever the script or rule named, without checking the account owns it. An authenticated user with a Sieve script or rule can make the server send mail as any address, signed with the domain's DKIM key where that domain is hosted.","category":"package","nicknames":[],"who_cares":["hmailserver","self-hosted","email","dkim","sieve"],"confidence":0.8,"needs_auth":"yes","worst_case":"Authenticated users send signed mail as any address, bypassing DMARC.","analyst_note":"Find the fixed hMailServer version and vendor advisory; the sources give only the affected range.","how_to_check":"- Check the installed hMailServer version; the notify action exists from `6.2.22` and the Reply rule action is affected from `6.0.0`.\n- Review Sieve scripts and mail rules that use notify or Reply actions for user-controlled From addresses.","needs_analyst":true,"not_affected_if":["no-user-sieve-scripts","no-mail-rules","managed-hosting"],"who_is_affected":"Servers running hMailServer 6.2.22 through 6.3.6 with Sieve notify, or 6.0.0 through 6.3.6 with mail-rule Reply actions, where users can store Sieve scripts or create rules. Users can reach this through ManageSieve, the REST API self-service filter, or the administration interface. Installations that do not let users store Sieve scripts or rules are not exposed to this path.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000708,"input_tokens":3730,"output_tokens":670,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-107568':12A,15A '-2026':11A,14A '6.0.0':100C '6.2.22':89C,283C '6.3.4':335C '6.3.6':91C,102C 'account':49B,158C,190C,311C,343C 'act':312C 'action':28B,34B,88C,99C,165C,276C,301C 'address':9A,38B,69B,119C,154C,221C,231C,299C,349C,353C 'administr':209C,321C 'align':266C 'allow':107C 'anywher':226C 'api':201C,324C,333C 'appli':166C,175C 'authent':2A,53B,109C 'author':83C 'behaviour':279C 'belong':155C,306C 'check':47B,151C,160C 'claim':230C 'com':183C,318C 'confin':326C 'could':211C,336C 'cve':10A,13A 'dkim':16B,75B,240C,252C,362C 'dmarc':272C 'domain':73B,79B,235C,250C,262C,270C,320C,329C,339C,357C,367C 'email':17B 'enabl':242C,364C 'engin':289C 'filter':206C 'forg':264C 'header':141C,260C 'hmailserv':1A,18B,24B,106C 'host':22B,81B,238C,360C 'interfac':210C 'introduc':281C 'key':76B,253C,325C,369C 'likewis':295C 'mail':6A,31B,66B,96C,113C,180C,265C,287C 'mail-rul':30B,95C,286C 'make':62B 'managesiev':198C 'messag':126C 'miss':82C 'name':45B,131C,302C 'notif':125C,138C,218C,247C 'notifi':27B,87C,122C,275C 'own':50B 'packag':19B 'pass':268C 'polici':273C 'produc':263C 'progress':104C 'queu':181C 'repli':33B,98C,293C,346C 'rest':200C,332C 'robot':105C 'rule':32B,44B,60B,97C,288C,291C,305C,316C,345C 'script':42B,58B,147C,196C 'self':21B,204C 'self-host':20B 'self-servic':203C 'send':5A,65B,112C,123C,216C 'sender':37B,133C,178C 'sent':185C,296C 'server':64B,116C,135C,174C,215C,224C,237C,244C,359C 'servic':205C 'set':35B,136C 'siev':23B,26B,57B,86C,121C,163C,195C 'sign':70B,241C,245C,256C,350C,363C 'store':193C 'tag':130C 'therefor':212C 'user':3A,54B,110C 'vacat':164C 'webmail':188C 'whatev':40B,298C 'whoever':303C 'without':46B,150C 'wrote':148C","nicknames":[],"mitigations":[],"who_affected":"Servers running hMailServer 6.2.22 through 6.3.6 with Sieve notify, or 6.0.0 through 6.3.6 with mail-rule Reply actions, where users can store Sieve scripts or create rules. Users can reach this through ManageSieve, the REST API self-service filter, or the administration interface. Installations that do not let users store Sieve scripts or rules are not exposed to this path.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T16:17:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","cvss_by":"cve@gitlab.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107568","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107568","severity":null,"published_at":"2026-10-19T16:17:01+00:00","modified_at":"2026-10-20T20:17:13+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}