CVE-2026-114476
Incorrect Authorization in hMailServer
02 Description
Incorrect Authorization in hMailServer
03 Exploitation and scoring
- Exploitation
- Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
- SSVC decision
- Not assessed by CISA
- EPSS probability
- 0.27% probability of exploitation activity in the next 30 days.
- EPSS percentile
- Equal to or higher than the score of 19.5% of scored records. A rank, not a probability.
- NVD base score
- 7.5 (CVSS v3.x), scored by the NVD independently of the CNA.
- NVD CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- NVD analysis status
- Awaiting Analysis. NVD last modified this record on 2026-10-22.
- Red Hat severity
- No Red Hat rating. Red Hat rates the CVEs that affect its products.
Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.
04 Metadata
- Published
- 2026-10-21 15:12Z7 DAYS AGO
- Last updated
- 2026-10-21 15:12Z7 DAYS AGO
- Reserved
- 2026-10-21
- Assigning CNA
- GitLab
- Record state
- PUBLISHED
- Severity
- High (CVSS 7.5)
- CNA CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-863Incorrect AuthorizationClass
- Data version
- 5.2
- Document digest
- 1dcadad24c3591a98bbdb42eb6c7c7deed6454e9450751d543ddbbaad611b7cb
05 Affected products
06 References
07 Remediation
Upgrade to hMailServer 6.3.7, in which a role is given or taken away, over the REST and the COM APIs, only by a credential that holds manage_roles in the account's domain and takes in both what the account holds now and what it will hold afterwards - with no role left, the authority of its admin level - so a credential confined to named domains is refused taking a role away from an account whose admin level is the server administrator's. Until then, give an account that a role narrows the admin level its role intends rather than the server administrator's, do not issue a full-scope API key, or assign serveradmin, confined to named domains to a party not trusted with the whole server, and review the role assignments and the accounts whose admin level is the server administrator's (after upgrading as well, since an upgrade does not give back a role already taken away).