---
id: "CVE-2026-114476"
kind: "vulnerability"
aliases: ["CVE-2026-114476"]
title: "hMailServer: REST API role removal lets domain admin become server admin"
severity: "high"
cvss: 7.5
epss: 0.00274
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["hmailserver", "mail-server", "package", "self-hosted"]
not_affected_if: ["default-config"]
published_at: "2026-10-21T16:17:34+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-25T03:16:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114476", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114476", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# hMailServer: REST API role removal lets domain admin become server admin

Progressive Robot hMailServer 6.3.4 through 6.3.6 has an authorization flaw in its REST administration API: a credential with the manage_roles permission in some domains can delete a narrowing role from an account in those domains, restoring server administrator authority. The attacker can then set that account's password and sign in as the server administrator.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed hMailServer version (`unknown` for the exact command; confirm from the install or the admin tool).
- Review API keys and accounts holding the manage_roles permission or the serveradmin role with a domain list.

## Fix

- Upgrade hMailServer past `6.3.6` (fixed version: unknown from sources; check the vendor advisory).
- Rotate full-scope API keys and review role assignments for domain-scoped accounts.

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114476
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114476

## From the sources

Incorrect authorization in the REST administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows a remote authenticated user whose credential holds the manage_roles permission in named domains - a full-scope API key issued for those domains, or an account assigned the serveradmin role with a list of domains - to obtain the server administrator's authority. An account's admin level gives it authority, and a role assigned to it replaces that authority, which is how an administrator narrows an account whose admin level is the server administrator's. The route that takes a role away (DELETE /api/v1/role-assignments/{address}) checked only that the credential takes in what the account held at the time, not what it would hold afterwards, so such a credential could take a narrowing role away from an account in its domains whose admin level is the server administrator's, returning it to the server administrator's authority, and, having set that account's password while it held the narrower role, sign in as the server administrator.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_