CVE-2026-114489
Missing Authorization in hMailServer
02 Description
Missing Authorization in hMailServer
03 Exploitation and scoring
- Exploitation
- Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
- SSVC decision
- Not assessed by CISA
- EPSS probability
- 0.27% probability of exploitation activity in the next 30 days.
- EPSS percentile
- Equal to or higher than the score of 19.4% of scored records. A rank, not a probability.
- NVD base score
- 8.1 (CVSS v3.x), scored by the NVD independently of the CNA.
- NVD CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- NVD analysis status
- Awaiting Analysis. NVD last modified this record on 2026-10-22.
- Red Hat severity
- No Red Hat rating. Red Hat rates the CVEs that affect its products.
Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.
04 Metadata
- Published
- 2026-10-21 15:34Z7 DAYS AGO
- Last updated
- 2026-10-21 15:34Z7 DAYS AGO
- Reserved
- 2026-10-21
- Assigning CNA
- GitLab
- Record state
- PUBLISHED
- Severity
- High (CVSS 8.1)
- CNA CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- Weaknesses
- CWE-862Missing AuthorizationClass
- Data version
- 5.2
- Document digest
- 5d67e0f1ed51cd81b0e2251ba99f6dc8e3697df86c37668c3c29d3897491b45f
05 Affected products
06 References
07 Remediation
Upgrade to hMailServer 6.3.7, which refuses the domain-alias create, the domain rename and an internal relay host to a credential that is confined to named domains, and the reaching rule actions (bind-to-address, send-using-route, script-function on an owned rule) to anyone but the server administrator, over both the REST and the COM APIs, while keeping the changes that stay inside the credential's domains. Until then, on a multi-tenant server, do not give a domain-administrator credential, a role that manages accounts in named domains, or a named-domain API key to a party not trusted with the whole server; keep the REST API off (RestApiPort=0, the default) where it is not needed; and review existing domain aliases, domain names, relay hosts and account/domain rule actions for entries a confined credential should not have made, and the accounts' own rules for these three actions, which withholding such credentials does not stop an account setting on its own rules over COM (do this after upgrading as well, since an upgrade does not undo a change already made).