CVE-2026-107568
Missing Authorization in hMailServer
02 Description
Missing Authorization in hMailServer
03 Exploitation and scoring
- Exploitation
- Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.
- SSVC decision
- ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
- AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
- Technical ImpactpartialSuccessful exploitation gives limited control of the vulnerable component.
- EPSS probability
- 0.24% probability of exploitation activity in the next 30 days.
- EPSS percentile
- Equal to or higher than the score of 15.4% of scored records. A rank, not a probability.
- NVD base score
- 6.5 (CVSS v3.x), scored by the NVD independently of the CNA.
- NVD CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- NVD analysis status
- Deferred. NVD last modified this record on 2026-10-20.
- Red Hat severity
- No Red Hat rating. Red Hat rates the CVEs that affect its products.
Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.
04 Metadata
- Published
- 2026-10-19 15:34Z10 DAYS AGO
- Last updated
- 2026-10-20 19:26Z8 DAYS AGO
- Reserved
- 2026-10-08
- Assigning CNA
- GitLab
- Record state
- PUBLISHED
- Severity
- Medium (CVSS 6.5)
- CNA CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- Weaknesses
- CWE-862Missing AuthorizationClass
- Data version
- 5.2
- Document digest
- ae42efee675f40be59eb20b7c875f072e19d550fe9145d501409f7eba25941db
05 Affected products
06 References
07 Remediation
Upgrade to hMailServer 6.3.7, which uses a Sieve notify :from only when it is an address that reaches the account (the account's own address or an active alias of it) - otherwise the notification goes from the account's own address, logged - and refuses a notify :from that is not an address when the script is stored, as the vacation action already does; and which sends a reply of an account's or a domain's mail rule only from an address the rule's owner may send as, refusing any other when the rule is saved and not sending a reply stored with one before (logged). Until then, where accounts need not set Sieve scripts, close the script surfaces: keep ManageSieve off (ManageSieveServerPort=0, the default) or bound to the loopback, and turn the REST API off where the webmail's filter editor is not wanted (RestApiPort=0, the default); and review active Sieve scripts for a notify whose :from is not the account's own address or an alias of it, and account and domain rules for a reply from an address the rule's owner may not send as. There is no per-extension setting that turns notify off while Sieve is in use.