hMailServer API Flaw Allows Authenticated Users to Hijack Mail Routing

A high-severity authorization failure in Progressive Robot hMailServer permits confined users to manipulate server-wide mail routing. This vulnerability exposes multi-tenant environments where domain administrators might intercept or deny mail for other organisations.

What happened

The issue, tracked as CVE-2026-114489, carries a CVSS score of 8.1, rated as high severity. It stems from missing authorization checks within the REST and COM administration APIs of hMailServer versions 6.0.0 through 6.3.6. According to the NVD record, a remote authenticated user whose credentials are limited to specific named domains can alter configurations outside those boundaries. On multi-tenant servers, this allows a domain administrator, an account with management roles, or a full-scope API key to impact other tenants. The authorization gate failed to restrict these actions for confined credentials, and handlers did not receive caller context.

Over the COM API, saving domain aliases performed no authorization check at all. Domain renaming required only domain administrator privileges, while rule saving required minimal permissions. Attackers can create domain aliases for any name, diverting mail to addresses they control or denying delivery entirely. They can also rename domains to names not hosted by the server. Furthermore, users can set rule actions to reach server addresses, configured route credentials, or event script functions. The domain relay host can be changed to an address on the server's own network, bypassing address rules.

Why it matters

This flaw undermines the isolation between tenants in shared hosting environments. A compromised or malicious domain administrator can intercept sensitive communications from other organisations. The ability to set relay hosts to internal addresses expands the attack surface beyond simple mail diversion. It allows attackers to access server resources or credentials stored in routes. The lack of authorization on COM API alias saves means even low-privilege accounts could potentially disrupt service. This breaks the trust model of multi-tenant email servers, where administrative boundaries are strictly enforced.

Next steps

• Identify all hMailServer installations running versions 6.0.0 through 6.3.6.
• Review API access logs for unauthorized configuration changes.
• Monitor for unexpected domain alias creations or relay host modifications.
• Restrict API key permissions to the minimum required scope.

Detection notes

Teams usually monitor API logs for configuration changes initiated by unexpected users. Check whether domain aliases or relay hosts were modified outside normal maintenance windows. Look for alerts on rule changes that reference internal server addresses or script functions. Verify that domain renaming attempts align with authorised administrative actions. Containment moves involve isolating affected domains and revoking suspicious API keys. Review event scripts for unauthorized modifications that could execute at delivery time. Ensure logging captures caller context for all API requests to trace the source of changes.

What to do and how to stay safe: hMailServer

• Audit API keys and remove any with broader permissions than necessary.
• Monitor server logs for unusual domain configuration changes.
• Implement network segmentation to limit access to administration interfaces.
• Wait for the vendor to provide an update before applying unofficial patches.

Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Production

General security guidance from the Packet Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which hMailServer versions are affected by CVE-2026-114489?

Versions 6.0.0 through 6.3.6 are affected by this authorization flaw.

Can an attacker intercept mail for other domains?

Yes, by creating domain aliases, an attacker can divert mail to their own address.

Is there a patch available for this vulnerability?

No fix has been confirmed yet according to the source material.