Vulnerability-Lookup

CVE-2026-114476 (GCVE-0-2026-114476)

Vulnerability from cvelistv5 – Published: 2026-10-21 15:12 – Updated: 2026-10-21 15:12

Title

Incorrect Authorization in hMailServer

Summary

Incorrect authorization in the REST administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows a remote authenticated user whose credential holds the manage_roles permission in named domains - a full-scope API key issued for those domains, or an account assigned the serveradmin role with a list of domains - to obtain the server administrator's authority. An account's admin level gives it authority, and a role assigned to it replaces that authority, which is how an administrator narrows an account whose admin level is the server administrator's. The route that takes a role away (DELETE /api/v1/role-assignments/{address}) checked only that the credential takes in what the account held at the time, not what it would hold afterwards, so such a credential could take a narrowing role away from an account in its domains whose admin level is the server administrator's, returning it to the server administrator's authority, and, having set that account's password while it held the narrower role, sign in as the server administrator.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-863 - Incorrect Authorization

Assigner

GitLab CNA under the mitre root

CNA scorecard C 75/100 over 339 records in the last 180 days details

References

2 references

URL	Tags
https://gitlab.com/hmailserver/hmailserver/-/work…
https://gitlab.com/hmailserver/hmailserver/-/rele…

Impacted products

1 product

Vendor	Product	Version	CPE status
Progressive Robot Ltd	hMailServer	Affected: 6.3.4 , ≤ 6.3.6 (semver)	guessed

Credits

Found in the hMailServer project's own security review (Progressive Robot Ltd)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "hMailServer",
          "repo": "https://gitlab.com/hmailserver/hmailserver",
          "vendor": "Progressive Robot Ltd",
          "versions": [
            {
              "lessThanOrEqual": "6.3.6",
              "status": "affected",
              "version": "6.3.4",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Found in the hMailServer project\u0027s own security review (Progressive Robot Ltd)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Incorrect authorization in the REST administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows a remote authenticated user whose credential holds the manage_roles permission in named domains - a full-scope API key issued for those domains, or an account assigned the serveradmin role with a list of domains - to obtain the server administrator\u0027s authority. An account\u0027s admin level gives it authority, and a role assigned to it replaces that authority, which is how an administrator narrows an account whose admin level is the server administrator\u0027s. The route that takes a role away (DELETE /api/v1/role-assignments/{address}) checked only that the credential takes in what the account held at the time, not what it would hold afterwards, so such a credential could take a narrowing role away from an account in its domains whose admin level is the server administrator\u0027s, returning it to the server administrator\u0027s authority, and, having set that account\u0027s password while it held the narrower role, sign in as the server administrator."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T15:12:25.844Z",
        "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
        "shortName": "GitLab"
      },
      "references": [
        {
          "url": "https://gitlab.com/hmailserver/hmailserver/-/work_items/88"
        },
        {
          "url": "https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.7"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to hMailServer 6.3.7, in which a role is given or taken away, over the REST and the COM APIs, only by a credential that holds manage_roles in the account\u0027s domain and takes in both what the account holds now and what it will hold afterwards - with no role left, the authority of its admin level - so a credential confined to named domains is refused taking a role away from an account whose admin level is the server administrator\u0027s. Until then, give an account that a role narrows the admin level its role intends rather than the server administrator\u0027s, do not issue a full-scope API key, or assign serveradmin, confined to named domains to a party not trusted with the whole server, and review the role assignments and the accounts whose admin level is the server administrator\u0027s (after upgrading as well, since an upgrade does not give back a role already taken away)."
        }
      ],
      "title": "Incorrect Authorization in hMailServer"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
    "assignerShortName": "GitLab",
    "cveId": "CVE-2026-114476",
    "datePublished": "2026-10-21T15:12:25.844Z",
    "dateReserved": "2026-10-21T15:11:35.852Z",
    "dateUpdated": "2026-10-21T15:12:25.844Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-114476",
      "date": "2026-10-25",
      "epss": "0.00274",
      "percentile": "0.19576"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "hMailServer",
                "repo": "https://gitlab.com/hmailserver/hmailserver",
                "vendor": "Progressive Robot Ltd",
                "versions": [
                  {
                    "lessThanOrEqual": "6.3.6",
                    "status": "affected",
                    "version": "6.3.4",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "cve@gitlab.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Incorrect authorization in the REST administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows a remote authenticated user whose credential holds the manage_roles permission in named domains - a full-scope API key issued for those domains, or an account assigned the serveradmin role with a list of domains - to obtain the server administrator\u0027s authority. An account\u0027s admin level gives it authority, and a role assigned to it replaces that authority, which is how an administrator narrows an account whose admin level is the server administrator\u0027s. The route that takes a role away (DELETE /api/v1/role-assignments/{address}) checked only that the credential takes in what the account held at the time, not what it would hold afterwards, so such a credential could take a narrowing role away from an account in its domains whose admin level is the server administrator\u0027s, returning it to the server administrator\u0027s authority, and, having set that account\u0027s password while it held the narrower role, sign in as the server administrator."
          }
        ],
        "id": "CVE-2026-114476",
        "lastModified": "2026-10-22T16:18:19.040",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.6,
              "impactScore": 5.9,
              "source": "cve@gitlab.com",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-10-21T16:17:34.947",
        "references": [
          {
            "source": "cve@gitlab.com",
            "url": "https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.7"
          },
          {
            "source": "cve@gitlab.com",
            "url": "https://gitlab.com/hmailserver/hmailserver/-/work_items/88"
          }
        ],
        "sourceIdentifier": "cve@gitlab.com",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-863"
              }
            ],
            "source": "cve@gitlab.com",
            "type": "Primary"
          }
        ]
      }
    }
  }
}

FKIE_CVE-2026-114476

Vulnerability from fkie_nvd - Published: 2026-10-21 16:17 - Updated: 2026-10-22 16:18

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	cve@gitlab.com	https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.7
	cve@gitlab.com	https://gitlab.com/hmailserver/hmailserver/-/work_items/88

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "hMailServer",
          "repo": "https://gitlab.com/hmailserver/hmailserver",
          "vendor": "Progressive Robot Ltd",
          "versions": [
            {
              "lessThanOrEqual": "6.3.6",
              "status": "affected",
              "version": "6.3.4",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "cve@gitlab.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Incorrect authorization in the REST administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows a remote authenticated user whose credential holds the manage_roles permission in named domains - a full-scope API key issued for those domains, or an account assigned the serveradmin role with a list of domains - to obtain the server administrator\u0027s authority. An account\u0027s admin level gives it authority, and a role assigned to it replaces that authority, which is how an administrator narrows an account whose admin level is the server administrator\u0027s. The route that takes a role away (DELETE /api/v1/role-assignments/{address}) checked only that the credential takes in what the account held at the time, not what it would hold afterwards, so such a credential could take a narrowing role away from an account in its domains whose admin level is the server administrator\u0027s, returning it to the server administrator\u0027s authority, and, having set that account\u0027s password while it held the narrower role, sign in as the server administrator."
    }
  ],
  "id": "CVE-2026-114476",
  "lastModified": "2026-10-22T16:18:19.040",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 5.9,
        "source": "cve@gitlab.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-10-21T16:17:34.947",
  "references": [
    {
      "source": "cve@gitlab.com",
      "url": "https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.7"
    },
    {
      "source": "cve@gitlab.com",
      "url": "https://gitlab.com/hmailserver/hmailserver/-/work_items/88"
    }
  ],
  "sourceIdentifier": "cve@gitlab.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ],
      "source": "cve@gitlab.com",
      "type": "Primary"
    }
  ]
}

GHSA-94CG-HQR8-P6WH

Vulnerability from github – Published: 2026-10-21 18:33 – Updated: 2026-10-21 18:33

Details

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-114476"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-21T16:17:34Z",
    "severity": "HIGH"
  },
  "details": "Incorrect authorization in the REST administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows a remote authenticated user whose credential holds the manage_roles permission in named domains - a full-scope API key issued for those domains, or an account assigned the serveradmin role with a list of domains - to obtain the server administrator\u0027s authority. An account\u0027s admin level gives it authority, and a role assigned to it replaces that authority, which is how an administrator narrows an account whose admin level is the server administrator\u0027s. The route that takes a role away (DELETE /api/v1/role-assignments/{address}) checked only that the credential takes in what the account held at the time, not what it would hold afterwards, so such a credential could take a narrowing role away from an account in its domains whose admin level is the server administrator\u0027s, returning it to the server administrator\u0027s authority, and, having set that account\u0027s password while it held the narrower role, sign in as the server administrator.",
  "id": "GHSA-94cg-hqr8-p6wh",
  "modified": "2026-10-21T18:33:16Z",
  "published": "2026-10-21T18:33:16Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114476"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.7"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/hmailserver/hmailserver/-/work_items/88"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-114476 (GCVE-0-2026-114476)

FKIE_CVE-2026-114476

GHSA-94CG-HQR8-P6WH

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour