{"id":"CVE-2026-114476","kind":"vulnerability","aliases":["CVE-2026-114476"],"related":[],"title":"hMailServer: REST API role removal lets domain admin become server admin","description":"Incorrect authorization in the REST administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows a remote authenticated user whose credential holds the manage_roles permission in named domains - a full-scope API key issued for those domains, or an account assigned the serveradmin role with a list of domains - to obtain the server administrator's authority. An account's admin level gives it authority, and a role assigned to it replaces that authority, which is how an administrator narrows an account whose admin level is the server administrator's. The route that takes a role away (DELETE /api/v1/role-assignments/{address}) checked only that the credential takes in what the account held at the time, not what it would hold afterwards, so such a credential could take a narrowing role away from an account in its domains whose admin level is the server administrator's, returning it to the server administrator's authority, and, having set that account's password while it held the narrower role, sign in as the server administrator.","summary":"Progressive Robot hMailServer 6.3.4 through 6.3.6 has an authorization flaw in its REST administration API: a credential with the manage_roles permission in some domains can delete a narrowing role from an account in those domains, restoring server administrator authority. The attacker can then set that account's password and sign in as the server administrator.","severity":"high","cvss":7.5,"epss":0.00274,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hmailserver","mail-server","package","self-hosted"],"not_affected_if":["default-config"],"how_to_check":"- Check the installed hMailServer version (`unknown` for the exact command; confirm from the install or the admin tool).\n- Review API keys and accounts holding the manage_roles permission or the serveradmin role with a domain list.","fix":"- Upgrade hMailServer past `6.3.6` (fixed version: unknown from sources; check the vendor advisory).\n- Rotate full-scope API keys and review role assignments for domain-scoped accounts.","status":"open","published_at":"2026-10-21T16:17:34+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T03:16:39+00:00","updated_at":"2026-10-25T03:16:39+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:16:39Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade hMailServer past `6.3.6` (fixed version: unknown from sources; check the vendor advisory).\n- Rotate full-scope API keys and review role assignments for domain-scoped accounts.","reach":"network","title":"hMailServer: REST API role removal lets domain admin become server admin","impact":"high","summary":"Progressive Robot hMailServer 6.3.4 through 6.3.6 has an authorization flaw in its REST administration API: a credential with the manage_roles permission in some domains can delete a narrowing role from an account in those domains, restoring server administrator authority. The attacker can then set that account's password and sign in as the server administrator.","category":"package","nicknames":[],"who_cares":["hmailserver","self-hosted","mail-server"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker becomes server administrator and can read or change all mail data.","analyst_note":"Find the vendor advisory or patched version number for hMailServer after 6.3.6 and confirm the REST API is the only affected surface.","how_to_check":"- Check the installed hMailServer version (`unknown` for the exact command; confirm from the install or the admin tool).\n- Review API keys and accounts holding the manage_roles permission or the serveradmin role with a domain list.","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Only installations running hMailServer 6.3.4 through 6.3.6 that use the REST administration API with domain-scoped credentials or accounts that hold manage_roles. Servers without the REST API in use, or with no domain-scoped admin credentials, have a smaller exposure.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.00066,"input_tokens":3569,"output_tokens":607,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-114476':14A,17A '-2026':13A,16A '/api/v1/role-assignments':181C '6.3.4':29B,93C '6.3.6':31B,95C 'account':58B,72B,123C,141C,164C,192C,215C,239C 'address':182C 'admin':8A,11A,143C,166C,220C 'administr':39B,64B,81B,87C,137C,161C,171C,225C,232C,253C 'afterward':202C 'allow':96C 'api':3A,40B,88C,115C 'assign':124C,151C 'attack':67B 'authent':99C 'author':34B,65B,83C,139C,147C,156C,234C 'away':179C,212C 'becom':9A 'check':183C 'could':207C 'credenti':42B,102C,187C,206C 'cve':12A,15A 'delet':52B,180C 'domain':7A,50B,61B,110C,120C,132C,218C 'flaw':35B 'full':113C 'full-scop':112C 'give':145C 'held':193C,244C 'hmailserv':1A,18B,28B,92C 'hold':103C,201C 'host':25B 'incorrect':82C 'issu':117C 'key':116C 'let':6A 'level':144C,167C,221C 'list':130C 'mail':20B 'mail-serv':19B 'manag':45B,105C 'name':109C 'narrow':54B,162C,210C,246C 'obtain':134C 'packag':22B 'password':74B,241C 'permiss':47B,107C 'progress':26B,90C 'remot':98C 'remov':5A 'replac':154C 'rest':2A,38B,86C 'restor':62B 'return':227C 'robot':27B,91C 'role':4A,46B,55B,106C,127C,150C,178C,211C,247C 'rout':174C 'scope':114C 'self':24B 'self-host':23B 'server':10A,21B,63B,80B,136C,170C,224C,231C,252C 'serveradmin':126C 'set':70B,237C 'sign':76B,248C 'take':176C,188C,208C 'time':196C 'user':100C 'whose':101C,165C,219C 'would':200C","nicknames":[],"mitigations":[],"who_affected":"Only installations running hMailServer 6.3.4 through 6.3.6 that use the REST administration API with domain-scoped credentials or accounts that hold manage_roles. Servers without the REST API in use, or with no domain-scoped admin credentials, have a smaller exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T16:17:34+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"cve@gitlab.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114476","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114476","severity":null,"published_at":"2026-10-21T16:17:34+00:00","modified_at":"2026-10-22T16:18:19+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114476","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114476","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}