{"id":"CVE-2026-114475","kind":"vulnerability","aliases":["CVE-2026-114475"],"related":[],"title":"hMailServer: domain-confined admin can edit roles across tenants","description":"Missing authorization in the REST role-management routes of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows a remote authenticated user whose credential is confined to named domains to modify a custom role that accounts in other domains hold, and to create custom roles and delete any that no account holds. The routes that create, update and delete a custom role require the manage_roles permission, which only the serveradmin role holds; but a full-scope API key issued for named domains, and serveradmin assigned with a domain list, are serveradmin confined to those domains and hold manage_roles. The server's authorization gate did not refuse the three role routes to a confined credential and the route named no domain, so a credential issued to one tenant could raise or lower the permissions of a custom role assigned across other tenants - granting another domain's role every permission over its mailboxes and settings, or removing what it needs. A custom role may not hold administer_server, administer_domain or manage_roles, so the confined credential cannot make itself or another a server administrator by creating or rewriting a custom role.","summary":"hMailServer's REST role-management routes do not check domain scope, so a credential limited to certain domains can modify custom roles held by accounts in other domains and create or delete custom roles. An attacker with such a tenant credential can change permissions for other tenants' roles, such as granting mailbox or settings control or removing needed access.","severity":"medium","cvss":6.5,"epss":0.00237,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hmailserver","mail-server","multi-tenant","package","self-hosted"],"not_affected_if":["default-config","single-domain"],"how_to_check":"- Check the installed hMailServer version (unknown if the sources give a command; the affected range is 6.3.4 through 6.3.6)\n- Review API keys and serveradmin assignments that are scoped to specific domains\n- Confirm whether custom roles are assigned to accounts in more than one domain","fix":"- Upgrade hMailServer past 6.3.6 (the fixed version is unknown from the sources)\n- Until patched, limit REST API keys and serveradmin assignments to trusted users and rotate any domain-scoped keys that may be exposed","status":"open","published_at":"2026-10-21T16:17:34+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T03:48:59+00:00","updated_at":"2026-10-25T03:48:59+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:48:59Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade hMailServer past 6.3.6 (the fixed version is unknown from the sources)\n- Until patched, limit REST API keys and serveradmin assignments to trusted users and rotate any domain-scoped keys that may be exposed","reach":"network","title":"hMailServer: domain-confined admin can edit roles across tenants","impact":"medium","summary":"hMailServer's REST role-management routes do not check domain scope, so a credential limited to certain domains can modify custom roles held by accounts in other domains and create or delete custom roles. An attacker with such a tenant credential can change permissions for other tenants' roles, such as granting mailbox or settings control or removing needed access.","category":"package","nicknames":[],"who_cares":["hmailserver","self-hosted","mail-server","multi-tenant"],"confidence":0.6,"needs_auth":"yes","worst_case":"Tenant admin alters other domains' roles, gaining mailbox and settings control","analyst_note":"Find the fixed hMailServer version and the vendor advisory for CVE-2026-114475; the sources give no patched release.","how_to_check":"- Check the installed hMailServer version (unknown if the sources give a command; the affected range is 6.3.4 through 6.3.6)\n- Review API keys and serveradmin assignments that are scoped to specific domains\n- Confirm whether custom roles are assigned to accounts in more than one domain","needs_analyst":true,"not_affected_if":["default-config","single-domain"],"who_is_affected":"Deployments running hMailServer 6.3.4 through 6.3.6 with the REST API enabled, where domain-scoped API keys or serveradmin accounts limited to some domains exist alongside custom roles used by other domains. Single-domain installs with no tenant separation have little to lose from this flaw. Installations that do not expose the REST API, or that run only full-admin accounts, are less exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000706,"input_tokens":3605,"output_tokens":691,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114475':13A,16A '-2026':12A,15A '6.3.4':101C '6.3.6':103C 'access':87B 'account':53B,122C,137C 'across':9A,228C 'admin':5A 'administ':254C,256C 'administr':272C 'allow':104C 'anoth':232C,269C 'api':165C 'assign':173C,227C 'attack':64B 'authent':107C 'author':89C,191C 'cannot':265C 'certain':45B 'chang':71B 'check':37B 'confin':4A,112C,180C,202C,263C 'control':83B 'could':217C 'creat':58B,129C,142C,274C 'credenti':42B,69B,110C,203C,212C,264C 'custom':49B,61B,119C,130C,147C,225C,249C,278C 'cve':11A,14A 'delet':60B,133C,145C 'domain':3A,38B,46B,56B,115C,125C,170C,176C,183C,209C,233C,257C 'domain-confin':2A 'edit':7A 'everi':236C 'full':163C 'full-scop':162C 'gate':192C 'grant':79B,231C 'held':51B 'hmailserv':1A,17B,28B,100C 'hold':126C,138C,159C,185C,253C 'host':27B 'issu':167C,213C 'key':166C 'limit':43B 'list':177C 'lower':220C 'mail':19B 'mail-serv':18B 'mailbox':80B,240C 'make':266C 'manag':33B,95C,151C,186C,259C 'may':251C 'miss':88C 'modifi':48B,117C 'multi':22B 'multi-ten':21B 'name':114C,169C,207C 'need':86B,247C 'one':215C 'packag':24B 'permiss':72B,153C,222C,237C 'progress':98C 'rais':218C 'refus':195C 'remot':106C 'remov':85B,244C 'requir':149C 'rest':30B,92C 'rewrit':276C 'robot':99C 'role':8A,32B,50B,62B,76B,94C,120C,131C,148C,152C,158C,187C,198C,226C,235C,250C,260C,279C 'role-manag':31B,93C 'rout':34B,96C,140C,199C,206C 'scope':39B,164C 'self':26B 'self-host':25B 'server':20B,189C,255C,271C 'serveradmin':157C,172C,179C 'set':82B,242C 'tenant':10A,23B,68B,75B,216C,230C 'three':197C 'updat':143C 'user':108C 'whose':109C","nicknames":[],"mitigations":[],"who_affected":"Deployments running hMailServer 6.3.4 through 6.3.6 with the REST API enabled, where domain-scoped API keys or serveradmin accounts limited to some domains exist alongside custom roles used by other domains. Single-domain installs with no tenant separation have little to lose from this flaw. Installations that do not expose the REST API, or that run only full-admin accounts, are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T16:17:34+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","cvss_by":"cve@gitlab.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114475","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114475","severity":null,"published_at":"2026-10-21T16:17:34+00:00","modified_at":"2026-10-22T16:18:19+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114475","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114475","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}