# CVE-2026-114475: Progressive Robot hMailServer REST authorization bypass in role management

Source: https://junglewise.ai/threats/cve-2026-114475-missing-authorization-in-the-rest-role-management-routes-of  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-114475 · Severity: medium · CVSS 6.5 · Published 2026-10-21

hMailServer is a mail server platform that handles email hosting and administration. A flaw in its REST API allows a restricted administrator who manages specific domains to modify roles that apply across other domains, potentially granting unauthorized mailbox and settings permissions to accounts in those other domains. This could allow one tenant to escalate privileges of their own accounts or restrict privileges of another tenant's accounts.

Technologies: [Progressive Robot hMailServer](https://junglewise.ai/threats/technologies/hmailserver). Vendors: [Progressive Robot](https://junglewise.ai/threats/vendors/progressive-robot).

## Quick answers

**Is CVE-2026-114475 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-114475 being exploited in the wild.

**How severe is CVE-2026-114475?** Medium severity, with a CVSS score of 6.5, published 21 October 2026.

**Which products and versions are affected?** Progressive Robot hMailServer 6.3.4 through 6.3.6.

**Is there a fix for CVE-2026-114475?** Yes: fixed in hMailServer 6.3.7. Until then: On multi-tenant servers, do not issue full-scope API keys or assign serveradmin confined to named domains to untrusted parties; keep the REST API disabled (RestApiPort = 0, the default) where not needed; and review custom roles for unauthorized permission changes made by confined credentials.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-10-21"},{"kind":"patched","at":"2026-10-21","note":"v6.3.7 released"},{"kind":"other","at":"2026-10-13","note":"Found in project's web-surface review"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-114475 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-114475?** Check whether you run Progressive Robot hMailServer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in hMailServer 6.3.7

On multi-tenant servers, do not issue full-scope API keys or assign serveradmin confined to named domains to untrusted parties; keep the REST API disabled (RestApiPort = 0, the default) where not needed; and review custom roles for unauthorized permission changes made by confined credentials.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-10-21"},{"kind":"patched","at":"2026-10-21","note":"v6.3.7 released"},{"kind":"other","at":"2026-10-13","note":"Found in project's web-surface review"}]

## Technical details

Missing authorization checks in three REST API endpoints (`POST /api/v1/roles`, `PUT /api/v1/roles/{name}`, `DELETE /api/v1/roles/{name}`) fail to validate domain scope for a confined serveradmin credential. An authenticated user with manage_roles permission confined to named domains can create, modify, or delete custom roles that are assigned across other domains, bypassing the authorization gate that should refuse these operations to non-global administrators.

## Affected products

- Progressive Robot hMailServer 6.3.4 through 6.3.6

## References

- [https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.7](https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.7)
- [https://gitlab.com/hmailserver/hmailserver/-/work_items/89](https://gitlab.com/hmailserver/hmailserver/-/work_items/89)

## Related threats

- [Progressive Robot hMailServer denial of service in web services listener](https://junglewise.ai/threats/cve-2026-126626-the-web-services-listener-of-progressive-robot-hmailserver-6-3-3)
- [hMailServer Windows installer privilege escalation via insecure folder permissions](https://junglewise.ai/threats/cve-2026-126625-incorrect-default-permissions-in-the-windows-installer-of)
- [hMailServer Windows installer privilege escalation in Bin folder](https://junglewise.ai/threats/cve-2026-126624-unverified-ownership-in-the-windows-installer-of-progressive)
- [Progressive Robot hMailServer inefficient JSON parsing DoS](https://junglewise.ai/threats/cve-2026-126623-inefficient-algorithmic-complexity-in-the-json-reader-of)
- [Progressive Robot hMailServer incorrect default installer permissions](https://junglewise.ai/threats/cve-2026-126622-incorrect-default-permissions-in-the-windows-installer-of)