---
id: "CVE-2026-114475"
kind: "vulnerability"
aliases: ["CVE-2026-114475"]
title: "hMailServer: domain-confined admin can edit roles across tenants"
severity: "medium"
cvss: 6.5
epss: 0.00237
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["hmailserver", "mail-server", "multi-tenant", "package", "self-hosted"]
not_affected_if: ["default-config", "single-domain"]
published_at: "2026-10-21T16:17:34+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-25T03:48:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114475", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114475", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# hMailServer: domain-confined admin can edit roles across tenants

hMailServer's REST role-management routes do not check domain scope, so a credential limited to certain domains can modify custom roles held by accounts in other domains and create or delete custom roles. An attacker with such a tenant credential can change permissions for other tenants' roles, such as granting mailbox or settings control or removing needed access.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed hMailServer version (unknown if the sources give a command; the affected range is 6.3.4 through 6.3.6)
- Review API keys and serveradmin assignments that are scoped to specific domains
- Confirm whether custom roles are assigned to accounts in more than one domain

## Fix

- Upgrade hMailServer past 6.3.6 (the fixed version is unknown from the sources)
- Until patched, limit REST API keys and serveradmin assignments to trusted users and rotate any domain-scoped keys that may be exposed

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114475
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114475

## From the sources

Missing authorization in the REST role-management routes of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows a remote authenticated user whose credential is confined to named domains to modify a custom role that accounts in other domains hold, and to create custom roles and delete any that no account holds. The routes that create, update and delete a custom role require the manage_roles permission, which only the serveradmin role holds; but a full-scope API key issued for named domains, and serveradmin assigned with a domain list, are serveradmin confined to those domains and hold manage_roles. The server's authorization gate did not refuse the three role routes to a confined credential and the route named no domain, so a credential issued to one tenant could raise or lower the permissions of a custom role assigned across other tenants - granting another domain's role every permission over its mailboxes and settings, or removing what it needs. A custom role may not hold administer_server, administer_domain or manage_roles, so the confined credential cannot make itself or another a server administrator by creating or rewriting a custom role.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_