---
id: "CVE-2026-114490"
kind: "vulnerability"
aliases: ["CVE-2026-114490"]
title: "hMailServer: scoped admin accounts gain full server control over COM"
severity: "high"
cvss: 7.8
epss: 0.00108
exploited: false
status: "open"
category: "package"
products: [{"name": "hMailServer", "fixed": ["6.3.7"], "affected": ">= 6.3.4, <= 6.3.6", "ecosystem": "vendor"}]
ecosystems: []
tags: ["com-api", "hmailserver", "mail-server", "multi-tenant", "package", "self-hosted", "windows"]
not_affected_if: ["default-config", "linux", "no-scoped-admin-roles"]
published_at: "2026-10-21T16:17:35+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-25T03:22:36+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114490", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114490", "first_seen_at": "2026-10-24T13:15:54+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:22:36+00:00"}]
---

# hMailServer: scoped admin accounts gain full server control over COM

hMailServer 6.3.4 through 6.3.6 has an authorization flaw in its COM administration API. A serveradmin account limited to a list of domains can act as the whole-server administrator, reading and changing every domain's accounts and mail and creating new server admins.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:hMailServer affected >= 6.3.4, <= 6.3.6 fixed 6.3.7

## How to check

Check the installed version is 6.3.4-6.3.6 (Windows only; Linux builds have no COM API). Then review role assignments: Control Panel > Accounts & domains > Administrator roles, or GET /api/v1/role-assignments. Look for any account assigned serveradmin with a non-empty domain list, or domainadmin with a list that leaves out the account's own domain.

## Fix

Upgrade to hMailServer 6.3.7 (released 17 Oct 2026); it applies from the account's next sign-in. Then review what any serveradmin-with-domain-list or domainadmin-with-list-excluding-own-domain account changed before the upgrade. Until upgraded: do not assign serveradmin with a domain list; use a custom role with only the needed permissions plus the domain list, or domainadmin with a list that includes the account's own domain.

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114490
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114490
- 2026-10-25T03:22:36+00:00 analyst — Vendor issue #87 and 6.3.7 release notes read: fixed in 6.3.7 (released 2026-10-17); Windows-only COM API; workaround and check from the issue. No exploitation or PoC seen; social search skipped (B tier).

## Documents

- [advisory] hMailServer work item 87: COM API serveradmin with domain list acts as whole-server admin https://gitlab.com/hmailserver/hmailserver/-/work_items/87
- [fix] hMailServer 6.3.7 release notes https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.7

## From the sources

Incorrect authorization in the COM administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows an account assigned the serveradmin role with a list of domains - a credential an administrator may create meaning to confine it to those domains - to act as the whole-server administrator over COM. Administrator roles are meant to confine such a credential to the domains its list names, and the REST API did not take it for the server administrator, but the COM API's server-administrator check read the administer_server permission as the whole server whatever list the grant carried. So the credential signed in through the Control Panel, or through a script run on the server, as the server administrator of every domain: it could read and change every domain's accounts and mail, rename any domain, map a domain alias onto any, write the server's settings and secrets, and create further server-administrator accounts. The COM API's domain-administrator check, asked with no domain, likewise let an account assigned the domainadmin role with a list of domains that leaves out the account's own domain administer that domain's ordinary accounts over COM. An account holding serveradmin with no list is the server administrator by design and is unaffected, as are the help desk, auditor and custom roles.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_