{"id":"CVE-2026-114475","revision":"3a8e5576ccf340d7af8098581d854395","records":[{"revision":"3a8e5576ccf340d7af8098581d854395","observedAt":"2026-10-29T21:48:56.968+00:00","statement":{"source":"cve-program","id":"CVE-2026-114475","aliases":[],"title":"Missing Authorization in hMailServer","description":"Missing authorization in the REST role-management routes of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows a remote authenticated user whose credential is confined to named domains to modify a custom role that accounts in other domains hold, and to create custom roles and delete any that no account holds. The routes that create, update and delete a custom role require the manage_roles permission, which only the serveradmin role holds; but a full-scope API key issued for named domains, and serveradmin assigned with a domain list, are serveradmin confined to those domains and hold manage_roles. The server's authorization gate did not refuse the three role routes to a confined credential and the route named no domain, so a credential issued to one tenant could raise or lower the permissions of a custom role assigned across other tenants - granting another domain's role every permission over its mailboxes and settings, or removing what it needs. A custom role may not hold administer_server, administer_domain or manage_roles, so the confined credential cannot make itself or another a server administrator by creating or rewriting a custom role.","state":0,"publishedAt":"2026-10-21T15:12:20.842+00:00","modifiedAt":"2026-10-29T20:56:12.86+00:00","affected":[{"ecosystem":"Vendor product","name":"hMailServer","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Progressive Robot Ltd\",\n                    \"product\": \"hMailServer\",\n                    \"repo\": \"https://gitlab.com/hmailserver/hmailserver\",\n                    \"versions\": [\n                        {\n                            \"version\": \"6.3.4\",\n                            \"status\": \"affected\",\n                            \"lessThanOrEqual\": \"6.3.6\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","score":6.5,"severity":"MEDIUM"}],"references":["https://gitlab.com/hmailserver/hmailserver/-/work_items/89","https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.7"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-114475","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-114475","identifiers":["CVE-2026-114475"]},"retained":false,"historicalAffected":[]}],"coverage":[]}