CVE-2026-114490

Incorrect Authorization in hMailServer

Upgrade to hMailServer 6.3.7, in which the one authorization rule answers administer_server only for a grant that reaches every domain, so an account assigned serveradmin with a list of domains is confined to the domains the list names, holding serveradmin's permissions in them short of what reaches beyond a domain and none in any other: over COM it is refused the server settings, a domain alias, a domain's name and the other changes that reach beyond a domain, exactly as over the REST API, where the same rule answers the check, and it is a domain administrator of its own account's domain where the list names that domain; it reaches the other domains its list names through REST, and over COM through the calls that name a domain of their own, among them the password reset, the unlock, the mailbox move and its history, the message trace, role assignment and a message's sender (send-as). An account assigned domainadmin with a list of domains likewise administers its own account's domain over COM only where the list names that domain. A grant with no list of domains is unchanged. Until then, do not assign the serveradmin role with a list of domains to a credential that must be confined: assign a custom role holding only the permissions it needs, with the list of domains, or the domainadmin role with a list of domains that names the account's own domain.