{"metadata": {"vulnerability": "CVE-2026-114489", "count": 10, "kinds": {"milestone": 4, "sighting": 1, "kev": 0, "other": 5}}, "data": [{"timestamp": "2026-10-21T15:33:56.489Z", "date_only": false, "value": "2026-10-21T15:33:56.489Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-114489", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-21T15:34:06.371Z", "date_only": false, "value": "2026-10-21T15:34:06.371Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-114489", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-21T15:34:06.371Z", "date_only": false, "value": "2026-10-21T15:34:06.371Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-114489", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-21T15:34:06.371Z", "date_only": false, "value": "2026-10-21T15:34:06.371Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitLab", "record": "CVE-2026-114489", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-21T16:17:35Z", "date_only": false, "value": "2026-10-21T16:17:35Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-4MCR-893F-MCPR", "record": "GHSA-4MCR-893F-MCPR", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-21T16:17:35.500Z", "date_only": false, "value": "2026-10-21T16:17:35.500", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-114489", "record": "FKIE_CVE-2026-114489", "field": "published"}, {"timestamp": "2026-10-21T18:33:16Z", "date_only": false, "value": "2026-10-21T18:33:16Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-4MCR-893F-MCPR", "record": "GHSA-4MCR-893F-MCPR", "field": "published"}, {"timestamp": "2026-10-21T18:33:16Z", "date_only": false, "value": "2026-10-21T18:33:16Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-4MCR-893F-MCPR", "record": "GHSA-4MCR-893F-MCPR", "field": "modified"}, {"timestamp": "2026-10-21T18:48:19.901Z", "date_only": false, "value": "2026-10-21T18:48:19.901635Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117480390616608755", "record": "CVE-2026-114489", "field": "creation_timestamp", "uuid": "4679a276-7111-4eb9-bfc2-ac5f4ffe679f", "content": "CVE-2026-114489 Missing Authorization in hMailServer Missing authorization in the REST and COM administration APIs of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote authenticated user whose credential is confined to named domains to change mail routing and domain configuration beyond those domains on a multi-tenant server. A domain administrator, an account or API key given another role that manages accounts in named domains, or a full-scope API key issued for named domains could create a domain alias for any name (so that other tenants' mail for that name is diverted to an address the attacker controls, or denied), rename a domain to any name the server does not host, set a rule's bind-to-address, send-using-route or script-function action to reach one of the server's own addresses, a configured route's stored credentials or a function of the server's event script, and set the domain's relay host - which delivery then connects to with no address rule - to an address on the server's own network; and over the COM API any account could set the three rule actions on its own rules, where the script-function action runs at delivery. The authorization gate did not refuse these routes to a confined credential and the handlers were not given the caller; over COM the domain-alias save performed no authorization check at all, the domain rename required only a domain administrator, and a rule save required at most that the caller could change the rule's owner.\nhttps://www.cve.org/CVERecord?id=CVE-2026-114489https://gitlab.com/hmailserver/hmailserver/-/work_items/86https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.7#ProgressiveRobotLtd #hMailServer#CVE_2026_114489#bot", "url": "https://infosec.exchange/users/cve/statuses/117480390616608755"}, {"timestamp": "2026-10-22T16:18:19.040Z", "date_only": false, "value": "2026-10-22T16:18:19.040", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-114489", "record": "FKIE_CVE-2026-114489", "field": "lastModified"}]}