{"id":"CVE-2026-114478","kind":"vulnerability","aliases":["CVE-2026-114478"],"related":[],"title":"hMailServer: forwarded mail can pass DMARC for a hosted domain","description":"Insufficient preservation of the original sender in the forwarding of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have mail they write, naming in its From an address at a domain the server hosts, delivered to other receivers as passing that domain's DMARC policy. When the server sent on a copy of mail that came from outside - an account's forward, a mail rule's forward, a Sieve redirect, a list's copy, or an alias or list expanding to an outside address - it could give the copy an SMTP identity in the organisation of the domain the copy's From names, whatever the message's origin: with the Sender Rewriting Scheme or the rewrite of the envelope sender on forwarding enabled (both off by default), an address at the forwarding domain; for a list, its bounce address; for a message with an empty envelope sender, none, under the server's own host name; and an envelope sender the message came with at a subdomain of a hosted domain was kept. Where that identity's SPF record authorises the server, other receivers' SPF check of the copy passed for a domain aligned with the From, and DMARC passed with it, although the message had not passed DMARC when the server received it. Exploitation needs a forward, redirect, alias or list that carries the hosted domain's mail to an outside address, and one of: SRS or the envelope rewrite enabled; a list whose bounce address is in the domain's organisation; an envelope sender at a subdomain whose SPF record authorises the server; or, for an empty envelope sender, an SPF record that authorises the server under its host name. The DKIM route to the same result is CVE-2026-107567.","summary":"hMailServer 6.0.0 through 6.3.6 can send forwarded, redirected or list copies of outside mail with an envelope sender inside a hosted domain's organisation. Receivers then see the copy pass SPF and DMARC for that domain, so an unauthenticated sender can spoof it.","severity":"medium","cvss":5.9,"epss":0.00261,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dmarc","email","hmailserver","package","self-hosted"],"not_affected_if":["envelope-rewrite-disabled","no-forwarding","srs-disabled"],"how_to_check":"- Check the hMailServer version (`6.3.6` and earlier are affected, 6.0.0 onward).\n- Check whether Sender Rewriting Scheme or envelope sender rewriting on forwarding is enabled in the server settings.\n- Check whether forwards, mail rules, Sieve redirects, or lists send mail from hosted domains to outside addresses.","fix":"- Upgrade hMailServer to a release after `6.3.6` (the fixed version is not named in the sources; unknown).\n- Until patched, leave Sender Rewriting Scheme and envelope sender rewriting disabled and review forwards and list bounce addresses.","status":"open","published_at":"2026-10-21T16:17:35+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T04:08:05+00:00","updated_at":"2026-10-25T04:08:05+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:08:05Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade hMailServer to a release after `6.3.6` (the fixed version is not named in the sources; unknown).\n- Until patched, leave Sender Rewriting Scheme and envelope sender rewriting disabled and review forwards and list bounce addresses.","reach":"internet","title":"hMailServer: forwarded mail can pass DMARC for a hosted domain","impact":"medium","summary":"hMailServer 6.0.0 through 6.3.6 can send forwarded, redirected or list copies of outside mail with an envelope sender inside a hosted domain's organisation. Receivers then see the copy pass SPF and DMARC for that domain, so an unauthenticated sender can spoof it.","category":"package","nicknames":[],"who_cares":["hmailserver","self-hosted","email","dmarc"],"confidence":0.7,"needs_auth":"no","worst_case":"Spoofed mail passes DMARC for a hosted domain","analyst_note":"Confirm the fixed hMailServer version and any vendor advisory; the sources do not name a patched release.","how_to_check":"- Check the hMailServer version (`6.3.6` and earlier are affected, 6.0.0 onward).\n- Check whether Sender Rewriting Scheme or envelope sender rewriting on forwarding is enabled in the server settings.\n- Check whether forwards, mail rules, Sieve redirects, or lists send mail from hosted domains to outside addresses.","needs_analyst":true,"not_affected_if":["no-forwarding","srs-disabled","envelope-rewrite-disabled"],"who_is_affected":"Mail servers running hMailServer 6.0.0 through 6.3.6 that forward, redirect or relay list mail from hosted domains to outside addresses. Exposure is greater when SRS or envelope rewrite is enabled, or when a list bounce address or subdomain sender is inside the hosted domain's organisation. Servers that only receive mail and do no forwarding are less exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.00074,"input_tokens":3799,"output_tokens":721,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-107567':361C '-114478':13A,16A '-2026':12A,15A,360C '6.0.0':25B,79C '6.3.6':27B,81C 'account':129C 'address':97C,153C,198C,208C,301C,315C 'alia':146C,288C 'align':262C 'allow':82C 'although':271C 'attack':86C 'authoris':248C,331C,344C 'bounc':207C,314C 'came':125C,231C 'carri':292C 'check':254C 'copi':34B,52B,121C,143C,158C,169C,257C 'could':155C 'cve':11A,14A,359C 'default':196C 'deliv':104C 'dkim':352C 'dmarc':6A,17B,56B,113C,267C,277C 'domain':10A,45B,59B,100C,111C,167C,202C,239C,261C,295C,319C 'email':18B 'empti':214C,337C 'enabl':192C,310C 'envelop':40B,188C,215C,227C,308C,323C,338C 'expand':149C 'exploit':283C 'forward':2A,30B,74C,131C,136C,191C,201C,286C 'give':156C 'hmailserv':1A,19B,24B,78C 'host':9A,23B,44B,103C,223C,238C,294C,349C 'ident':161C,244C 'insid':42B 'insuffici':66C 'kept':241C 'list':33B,141C,148C,205C,290C,312C 'mail':3A,37B,89C,123C,133C,297C 'messag':175C,211C,230C,273C 'name':92C,172C,224C,350C 'need':284C 'none':217C 'one':303C 'organis':47B,164C,321C 'origin':70C,177C 'outsid':36B,127C,152C,300C 'packag':20B 'pass':5A,53B,109C,258C,268C,276C 'polici':114C 'preserv':67C 'progress':76C 'receiv':48B,107C,252C,281C 'record':247C,330C,342C 'redirect':31B,139C,287C 'remot':84C 'result':357C 'rewrit':181C,185C,309C 'robot':77C 'rout':353C 'rule':134C 'scheme':182C 'see':50B 'self':22B 'self-host':21B 'send':29B 'sender':41B,63B,71C,180C,189C,216C,228C,324C,339C 'sent':118C 'server':102C,117C,220C,250C,280C,333C,346C 'siev':138C 'smtp':160C 'spf':54B,246C,253C,329C,341C 'spoof':65B 'srs':305C 'subdomain':235C,327C 'unauthent':62B,85C 'whatev':173C 'whose':313C,328C 'write':91C","nicknames":[],"mitigations":[],"who_affected":"Mail servers running hMailServer 6.0.0 through 6.3.6 that forward, redirect or relay list mail from hosted domains to outside addresses. Exposure is greater when SRS or envelope rewrite is enabled, or when a list bounce address or subdomain sender is inside the hosted domain's organisation. Servers that only receive mail and do no forwarding are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T16:17:35+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","cvss_by":"cve@gitlab.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114478","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114478","severity":null,"published_at":"2026-10-21T16:17:35+00:00","modified_at":"2026-10-22T16:18:19+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114478","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114478","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}