{"id":"CVE-2026-114470","revision":"26394b997b9e44a8ae3c6db5939291d8","records":[{"revision":"26394b997b9e44a8ae3c6db5939291d8","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-114470","aliases":[],"title":"Cross-Site Request Forgery (CSRF) in hMailServer","description":"Cross-site request forgery in the REST API of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote attacker to make an authenticated user's browser perform a state-changing request. The REST API accepts HTTP Basic authentication and answers a browser with a Basic sign-in box; a browser caches the credential once the box is answered and sends it with later requests to that origin, including a top-level form post from another site, and the server reads a request body whatever its declared content type. The cross-site protection covered only the cookie session (a header a cross-site form cannot set, and a SameSite=Strict cookie); HTTP Basic was not held to it. A page under an attacker's control, visited by a user whose browser holds a cached Basic credential for the REST API - typically an administrator who signed in through the box - could therefore cause a state-changing request such as creating a domain, an account or an API key, or changing a setting, with the victim's credential. The attacker cannot read the cross-origin response, so the forgery is blind.","state":0,"publishedAt":"2026-10-21T15:11:20.847+00:00","modifiedAt":"2026-10-21T15:11:20.847+00:00","affected":[{"ecosystem":"Vendor product","name":"hMailServer","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Progressive Robot Ltd\",\n                    \"product\": \"hMailServer\",\n                    \"repo\": \"https://gitlab.com/hmailserver/hmailserver\",\n                    \"versions\": [\n                        {\n                            \"version\": \"6.0.0\",\n                            \"status\": \"affected\",\n                            \"lessThanOrEqual\": \"6.3.6\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N","score":5.3,"severity":"MEDIUM"}],"references":["https://gitlab.com/hmailserver/hmailserver/-/work_items/93","https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.7"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-114470","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-114470","identifiers":["CVE-2026-114470"]},"retained":false,"historicalAffected":[]}],"coverage":[]}