# CVE-2026-114476: hMailServer REST API authorization bypass in role management

Source: https://junglewise.ai/threats/cve-2026-114476-incorrect-authorization-in-the-rest-administration-api-of  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-114476 · Severity: high · CVSS 7.5 · Published 2026-10-21

hMailServer is an email server that can be managed remotely via a REST API. An attacker with credentials to manage roles in specific domains can trick the server into granting full server administrator access by removing a narrowing role from a privileged account, potentially compromising all email accounts and server data.

Technologies: [Progressive Robot hMailServer](https://junglewise.ai/threats/technologies/hmailserver). Vendors: [Progressive Robot](https://junglewise.ai/threats/vendors/progressive-robot).

## Quick answers

**Is CVE-2026-114476 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-114476 being exploited in the wild.

**How severe is CVE-2026-114476?** High severity, with a CVSS score of 7.5, published 21 October 2026.

**Which products and versions are affected?** Progressive Robot hMailServer 6.3.4 through 6.3.6.

**Is there a fix for CVE-2026-114476?** Yes: fixed in 6.3.7. Until then: Until upgrading, assign server-administrator accounts only admin levels corresponding to their intended role rather than the server administrator level, and do not issue full-scope API keys or assign serveradmin role with named domain restrictions to parties not trusted with full server access. Review all role assignments and accounts with server administrator admin levels. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-114476 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-114476?** Check whether you run Progressive Robot hMailServer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 6.3.7

Until upgrading, assign server-administrator accounts only admin levels corresponding to their intended role rather than the server administrator level, and do not issue full-scope API keys or assign serveradmin role with named domain restrictions to parties not trusted with full server access. Review all role assignments and accounts with server administrator admin levels.

## Technical details

The REST administration API in hMailServer 6.3.4-6.3.6 fails to properly check authorization when removing role assignments via DELETE /api/v1/role-assignments/{address}. The vulnerability allows an authenticated user with manage_roles permission in named domains to remove a narrowing role from a server administrator account, restoring full server-level authority. An attacker who previously set the target account's password while it held the narrower role can then sign in as a full server administrator.

## Affected products

- Progressive Robot hMailServer 6.3.4 through 6.3.6

## Timeline

- 2026-10-21: disclosed
- 2026-10-21: patched: version 6.3.7 released

## References

- [https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.7](https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.7)
- [https://gitlab.com/hmailserver/hmailserver/-/work_items/88](https://gitlab.com/hmailserver/hmailserver/-/work_items/88)

## Related threats

- [Progressive Robot hMailServer denial of service in web services listener](https://junglewise.ai/threats/cve-2026-126626-the-web-services-listener-of-progressive-robot-hmailserver-6-3-3)
- [hMailServer Windows installer privilege escalation via insecure folder permissions](https://junglewise.ai/threats/cve-2026-126625-incorrect-default-permissions-in-the-windows-installer-of)
- [hMailServer Windows installer privilege escalation in Bin folder](https://junglewise.ai/threats/cve-2026-126624-unverified-ownership-in-the-windows-installer-of-progressive)
- [Progressive Robot hMailServer inefficient JSON parsing DoS](https://junglewise.ai/threats/cve-2026-126623-inefficient-algorithmic-complexity-in-the-json-reader-of)
- [Progressive Robot hMailServer incorrect default installer permissions](https://junglewise.ai/threats/cve-2026-126622-incorrect-default-permissions-in-the-windows-installer-of)