{"id":"CVE-2026-114470","kind":"vulnerability","aliases":["CVE-2026-114470"],"related":[],"title":"hMailServer: cross-site requests ride cached Basic credentials to the REST API","description":"Cross-site request forgery in the REST API of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote attacker to make an authenticated user's browser perform a state-changing request. The REST API accepts HTTP Basic authentication and answers a browser with a Basic sign-in box; a browser caches the credential once the box is answered and sends it with later requests to that origin, including a top-level form post from another site, and the server reads a request body whatever its declared content type. The cross-site protection covered only the cookie session (a header a cross-site form cannot set, and a SameSite=Strict cookie); HTTP Basic was not held to it. A page under an attacker's control, visited by a user whose browser holds a cached Basic credential for the REST API - typically an administrator who signed in through the box - could therefore cause a state-changing request such as creating a domain, an account or an API key, or changing a setting, with the victim's credential. The attacker cannot read the cross-origin response, so the forgery is blind.","summary":"The hMailServer REST API accepts HTTP Basic authentication, and browsers cache that credential and send it on cross-site form posts, so the existing cross-site protection does not cover it. A malicious page visited by a logged-in administrator can make the browser create domains, accounts, API keys or change settings, though the attacker cannot read the responses.","severity":"medium","cvss":5.3,"epss":0.00153,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hmailserver","mail-server","package","self-hosted"],"not_affected_if":["default-config","patched-release"],"how_to_check":"- Look for the hMailServer version in the installed package or service, e.g. `hmailserver --version` or the install's version file: unknown\n- Check whether the REST API is enabled and reachable from a browser on an administrator's workstation: unknown","fix":"- Upgrade hMailServer to a release after `6.3.6`: unknown exact fixed version in the sources\n- Until patched, restrict REST API access to trusted networks and avoid browsing the web while signed in to the API in the same browser: unknown","status":"open","published_at":"2026-10-21T16:17:34+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T04:20:52+00:00","updated_at":"2026-10-25T04:20:52+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:20:52Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade hMailServer to a release after `6.3.6`: unknown exact fixed version in the sources\n- Until patched, restrict REST API access to trusted networks and avoid browsing the web while signed in to the API in the same browser: unknown","reach":"internet","title":"hMailServer: cross-site requests ride cached Basic credentials to the REST API","impact":"medium","summary":"The hMailServer REST API accepts HTTP Basic authentication, and browsers cache that credential and send it on cross-site form posts, so the existing cross-site protection does not cover it. A malicious page visited by a logged-in administrator can make the browser create domains, accounts, API keys or change settings, though the attacker cannot read the responses.","category":"package","nicknames":[],"who_cares":["hmailserver","self-hosted","mail-server"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker blindly creates accounts or changes mail server settings via victim's browser","analyst_note":"Confirm the fixed hMailServer version and whether the REST API is on by default; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-114470 and the vendor advisory.","how_to_check":"- Look for the hMailServer version in the installed package or service, e.g. `hmailserver --version` or the install's version file: unknown\n- Check whether the REST API is enabled and reachable from a browser on an administrator's workstation: unknown","needs_analyst":true,"not_affected_if":["default-config","patched-release"],"who_is_affected":"Installations running hMailServer 6.0.0 through 6.3.6 with the REST API enabled are exposed. The risk is highest where an administrator signs in to the REST API through the browser Basic sign-in box, since that cached credential is what gets reused. Sites that do not use the REST API or run a patched release can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000702,"input_tokens":3599,"output_tokens":685,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114470':16A,19A '-2026':15A,18A '6.0.0':103C '6.3.6':105C 'accept':32B,126C 'account':77B,258C 'administr':70B,237C 'allow':106C 'anoth':168C 'answer':131C,150C 'api':13A,31B,78B,98C,125C,234C,261C 'attack':85B,109C,217C,273C 'authent':35B,113C,129C 'basic':8A,34B,128C,136C,207C,229C 'blind':285C 'bodi':176C 'box':140C,148C,243C 'browser':37B,74B,116C,133C,142C,225C 'cach':7A,38B,143C,228C 'cannot':86B,199C,274C 'caus':246C 'chang':81B,121C,250C,264C 'content':180C 'control':219C 'cooki':190C,205C 'could':244C 'cover':59B,187C 'creat':75B,254C 'credenti':9A,40B,145C,230C,271C 'cross':3A,46B,54B,91C,184C,196C,278C 'cross-origin':277C 'cross-sit':2A,45B,53B,90C,183C,195C 'cve':14A,17A 'declar':179C 'domain':76B,256C 'exist':52B 'forgeri':94C,283C 'form':48B,165C,198C 'header':193C 'held':210C 'hmailserv':1A,20B,29B,102C 'hold':226C 'host':27B 'http':33B,127C,206C 'includ':160C 'key':79B,262C 'later':155C 'level':164C 'log':68B 'logged-in':67B 'mail':22B 'mail-serv':21B 'make':72B,111C 'malici':62B 'origin':159C,279C 'packag':24B 'page':63B,214C 'perform':117C 'post':49B,166C 'progress':100C 'protect':56B,186C 'read':87B,173C,275C 'remot':108C 'request':5A,93C,122C,156C,175C,251C 'respons':89B,280C 'rest':12A,30B,97C,124C,233C 'ride':6A 'robot':101C 'samesit':203C 'self':26B 'self-host':25B 'send':42B,152C 'server':23B,172C 'session':191C 'set':82B,200C,266C 'sign':138C,239C 'sign-in':137C 'site':4A,47B,55B,92C,169C,185C,197C 'state':120C,249C 'state-chang':119C,248C 'strict':204C 'therefor':245C 'though':83B 'top':163C 'top-level':162C 'type':181C 'typic':235C 'user':114C,223C 'victim':269C 'visit':64B,220C 'whatev':177C 'whose':224C","nicknames":[],"mitigations":[],"who_affected":"Installations running hMailServer 6.0.0 through 6.3.6 with the REST API enabled are exposed. The risk is highest where an administrator signs in to the REST API through the browser Basic sign-in box, since that cached credential is what gets reused. Sites that do not use the REST API or run a patched release can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T16:17:34+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N","cvss_by":"cve@gitlab.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114470","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114470","severity":null,"published_at":"2026-10-21T16:17:34+00:00","modified_at":"2026-10-22T16:18:19+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114470","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114470","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}