{"id":"CVE-2026-114490","kind":"vulnerability","aliases":["CVE-2026-114490"],"related":[],"title":"hMailServer: scoped admin accounts gain full server control over COM","description":"Incorrect authorization in the COM administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows an account assigned the serveradmin role with a list of domains - a credential an administrator may create meaning to confine it to those domains - to act as the whole-server administrator over COM. Administrator roles are meant to confine such a credential to the domains its list names, and the REST API did not take it for the server administrator, but the COM API's server-administrator check read the administer_server permission as the whole server whatever list the grant carried. So the credential signed in through the Control Panel, or through a script run on the server, as the server administrator of every domain: it could read and change every domain's accounts and mail, rename any domain, map a domain alias onto any, write the server's settings and secrets, and create further server-administrator accounts. The COM API's domain-administrator check, asked with no domain, likewise let an account assigned the domainadmin role with a list of domains that leaves out the account's own domain administer that domain's ordinary accounts over COM. An account holding serveradmin with no list is the server administrator by design and is unaffected, as are the help desk, auditor and custom roles.","summary":"hMailServer 6.3.4 through 6.3.6 has an authorization flaw in its COM administration API. A serveradmin account limited to a list of domains can act as the whole-server administrator, reading and changing every domain's accounts and mail and creating new server admins.","severity":"high","cvss":7.8,"epss":0.00108,"exploited":false,"exploited_at":null,"products":[{"name":"hMailServer","fixed":["6.3.7"],"affected":">= 6.3.4, <= 6.3.6","ecosystem":"vendor"}],"ecosystems":[],"tags":["com-api","hmailserver","mail-server","multi-tenant","package","self-hosted","windows"],"not_affected_if":["default-config","linux","no-scoped-admin-roles"],"how_to_check":"Check the installed version is 6.3.4-6.3.6 (Windows only; Linux builds have no COM API). Then review role assignments: Control Panel > Accounts & domains > Administrator roles, or GET /api/v1/role-assignments. Look for any account assigned serveradmin with a non-empty domain list, or domainadmin with a list that leaves out the account's own domain.","fix":"Upgrade to hMailServer 6.3.7 (released 17 Oct 2026); it applies from the account's next sign-in. Then review what any serveradmin-with-domain-list or domainadmin-with-list-excluding-own-domain account changed before the upgrade. Until upgraded: do not assign serveradmin with a domain list; use a custom role with only the needed permissions plus the domain list, or domainadmin with a list that includes the account's own domain.","status":"open","published_at":"2026-10-21T16:17:35+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T03:08:23+00:00","updated_at":"2026-10-25T03:22:36+00:00","category":"package","confidence":0.9,"triage":{"at":"2026-10-25T03:08:23Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"hMailServer: scoped admin accounts gain full server control over COM","impact":"high","summary":"hMailServer 6.3.4 through 6.3.6 has an authorization flaw in its COM administration API. A serveradmin account limited to a list of domains can act as the whole-server administrator, reading and changing every domain's accounts and mail and creating new server admins.","category":"package","nicknames":[],"who_cares":["hmailserver","self-hosted","mail-server"],"confidence":0.7,"needs_auth":"yes","worst_case":"scoped admin gains whole-server control, reads all mail and secrets","analyst_note":"Confirm the fixed hMailServer version and the vendor advisory; the sources give no fix version or check command.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["default-config","no-scoped-admin-roles"],"who_is_affected":"Servers running hMailServer 6.3.4 through 6.3.6 where an admin account was given the serveradmin or domainadmin role with a domain list. Accounts with serveradmin and no domain list are the server administrator by design and are unaffected, as are help desk, auditor and custom roles.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000591,"input_tokens":3644,"output_tokens":454,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed hMailServer version and the vendor advisory; the sources give no fix version or check command.","search":"'-114490':13A,16A '-2026':12A,15A '6.3.4':34B,88C '6.3.6':36B,90C 'account':4A,48B,69B,93C,208C,233C,249C,263C,272C,276C 'act':56B,117C 'admin':3A,76B 'administ':164C,267C 'administr':44B,62B,82C,106C,123C,126C,152C,160C,196C,232C,240C,285C 'alia':217C 'allow':91C 'api':20B,45B,83C,144C,156C,236C 'ask':242C 'assign':94C,250C 'auditor':296C 'author':39B,78C 'carri':175C 'chang':65B,204C 'check':161C,241C 'com':10A,19B,43B,81C,125C,155C,235C,274C 'com-api':18B 'confin':111C,131C 'control':8A,183C 'could':201C 'creat':73B,108C,228C 'credenti':104C,134C,178C 'custom':298C 'cve':11A,14A 'design':287C 'desk':295C 'domain':54B,67B,102C,115C,137C,199C,206C,213C,216C,239C,245C,258C,266C,269C 'domain-administr':238C 'domainadmin':252C 'everi':66B,198C,205C 'flaw':40B 'full':6A 'gain':5A 'grant':174C 'help':294C 'hmailserv':1A,21B,33B,87C 'hmailserver':17A 'hold':277C 'host':31B 'incorrect':77C 'leav':260C 'let':247C 'likewis':246C 'limit':49B 'list':52B,100C,139C,172C,256C,281C 'mail':23B,71B,210C 'mail-serv':22B 'map':214C 'may':107C 'mean':109C 'meant':129C 'multi':26B 'multi-ten':25B 'name':140C 'new':74B 'onto':218C 'ordinari':271C 'packag':28B 'panel':184C 'permiss':166C 'progress':85C 'read':63B,162C,202C 'renam':211C 'rest':143C 'robot':86C 'role':97C,127C,253C,299C 'run':189C 'scope':2A 'script':188C 'secret':226C 'self':30B 'self-host':29B 'server':7A,24B,61B,75B,122C,151C,159C,165C,170C,192C,195C,222C,231C,284C 'server-administr':158C,230C 'serveradmin':47B,96C,278C 'set':224C 'sign':179C 'take':147C 'tenant':27B 'unaffect':290C 'whatev':171C 'whole':60B,121C,169C 'whole-serv':59B,120C 'window':32B 'write':220C","nicknames":[],"mitigations":[],"who_affected":"Windows hMailServer 6.3.4 through 6.3.6 servers, mainly multi-tenant or hosting setups, where an admin account was given serveradmin with a list of domains (or domainadmin with a list that omits its own domain). Such an account can sign in over COM (Control Panel or a local script) as the full server administrator. Skip if you have no scoped admin roles, only serveradmin with no list, or run Linux builds or versions before 6.3.4.","tier":"B","verified":{"fix":{"at":"2026-10-25T03:22:36Z","by":"analyst","run_id":704},"products":{"at":"2026-10-25T03:22:36Z","by":"analyst","run_id":704},"workarounds":{"at":"2026-10-25T03:22:36Z","by":"analyst","run_id":704},"how_to_check":{"at":"2026-10-25T03:22:36Z","by":"analyst","run_id":704},"who_affected":{"at":"2026-10-25T03:22:36Z","by":"analyst","run_id":704}},"analyst_revisit_at":null,"first_public_at":"2026-10-21T16:17:35+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"cve@gitlab.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114490","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114490","severity":null,"published_at":"2026-10-21T16:17:35+00:00","modified_at":"2026-10-22T16:18:19+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114490","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114490","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-114490:704","url":null,"severity":null,"published_at":"2026-10-25T03:22:36+00:00","modified_at":"2026-10-25T03:22:36+00:00","first_seen_at":"2026-10-25T03:22:36+00:00","fetched_at":"2026-10-25T03:22:36+00:00","note":"Vendor issue #87 and 6.3.7 release notes read: fixed in 6.3.7 (released 2026-10-17); Windows-only COM API; workaround and check from the issue. No exploitation or PoC seen; social search skipped (B tier)."}],"documents":[{"id":3133,"url":"https://gitlab.com/hmailserver/hmailserver/-/work_items/87","title":"hMailServer work item 87: COM API serveradmin with domain list acts as whole-server admin","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3134,"url":"https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.7","title":"hMailServer 6.3.7 release notes","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}