{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "hMailServer",
          "repo": "https://gitlab.com/hmailserver/hmailserver",
          "vendor": "Progressive Robot Ltd",
          "versions": [
            {
              "lessThanOrEqual": "6.3.6",
              "status": "affected",
              "version": "6.3.4",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Found in the hMailServer project\u0027s own security review (Progressive Robot Ltd)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Incorrect authorization in the COM administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows an account assigned the serveradmin role with a list of domains - a credential an administrator may create meaning to confine it to those domains - to act as the whole-server administrator over COM. Administrator roles are meant to confine such a credential to the domains its list names, and the REST API did not take it for the server administrator, but the COM API\u0027s server-administrator check read the administer_server permission as the whole server whatever list the grant carried. So the credential signed in through the Control Panel, or through a script run on the server, as the server administrator of every domain: it could read and change every domain\u0027s accounts and mail, rename any domain, map a domain alias onto any, write the server\u0027s settings and secrets, and create further server-administrator accounts. The COM API\u0027s domain-administrator check, asked with no domain, likewise let an account assigned the domainadmin role with a list of domains that leaves out the account\u0027s own domain administer that domain\u0027s ordinary accounts over COM. An account holding serveradmin with no list is the server administrator by design and is unaffected, as are the help desk, auditor and custom roles."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T15:34:11.363Z",
        "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
        "shortName": "GitLab"
      },
      "references": [
        {
          "url": "https://gitlab.com/hmailserver/hmailserver/-/work_items/87"
        },
        {
          "url": "https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.7"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to hMailServer 6.3.7, in which the one authorization rule answers administer_server only for a grant that reaches every domain, so an account assigned serveradmin with a list of domains is confined to the domains the list names, holding serveradmin\u0027s permissions in them short of what reaches beyond a domain and none in any other: over COM it is refused the server settings, a domain alias, a domain\u0027s name and the other changes that reach beyond a domain, exactly as over the REST API, where the same rule answers the check, and it is a domain administrator of its own account\u0027s domain where the list names that domain; it reaches the other domains its list names through REST, and over COM through the calls that name a domain of their own, among them the password reset, the unlock, the mailbox move and its history, the message trace, role assignment and a message\u0027s sender (send-as). An account assigned domainadmin with a list of domains likewise administers its own account\u0027s domain over COM only where the list names that domain. A grant with no list of domains is unchanged. Until then, do not assign the serveradmin role with a list of domains to a credential that must be confined: assign a custom role holding only the permissions it needs, with the list of domains, or the domainadmin role with a list of domains that names the account\u0027s own domain."
        }
      ],
      "title": "Incorrect Authorization in hMailServer"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
    "assignerShortName": "GitLab",
    "cveId": "CVE-2026-114490",
    "datePublished": "2026-10-21T15:34:11.363Z",
    "dateReserved": "2026-10-21T15:34:01.382Z",
    "dateUpdated": "2026-10-21T15:34:11.363Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}