Is CVE-2026-114477 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-114477 being exploited in the wild.

How severe is CVE-2026-114477?

Medium severity, with a CVSS score of 4.3, published 21 October 2026.

Which products and versions are affected?

Progressive Robot hMailServer 6.2.25 through 6.3.6.

How is CVE-2026-114477 attacked?

It is attacked over the network.

Am I affected by CVE-2026-114477?

Check whether you run Progressive Robot hMailServer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114477: Progressive Robot hMailServer missing authorization in REST metrics route

CVE-2026-114477 · Severity: medium · CVSS 4.3 · Published 2026-10-21

hMailServer is an open-source mail server that supports multi-tenant deployments with domain administrators. A missing authorization check in the REST API metrics endpoint allows domain administrators and auditors with access to specific domains to read server-wide traffic statistics they should not see. This is information disclosure that breaches tenant isolation on shared mail servers.

Technologies: Progressive Robot hMailServer. Vendors: Progressive Robot.

Quick answers

Is CVE-2026-114477 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-114477 being exploited in the wild.
How severe is CVE-2026-114477?: Medium severity, with a CVSS score of 4.3, published 21 October 2026.
Which products and versions are affected?: Progressive Robot hMailServer 6.2.25 through 6.3.6.
Is there a fix for CVE-2026-114477?: Yes: fixed in hMailServer 6.3.7. Until then: Until upgrading to 6.3.7, on multi-tenant servers do not issue domain-administrator credentials, domain-scoped roles with view_configuration permission, or named-domain API keys to parties not trusted with server-wide traffic statistics; keep the REST API disabled (RestApiPort = 0, the default) if not needed. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-114477 attacked?: It is attacked over the network.
Am I affected by CVE-2026-114477?: Check whether you run Progressive Robot hMailServer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: hMailServer 6.3.7

Until upgrading to 6.3.7, on multi-tenant servers do not issue domain-administrator credentials, domain-scoped roles with view_configuration permission, or named-domain API keys to parties not trusted with server-wide traffic statistics; keep the REST API disabled (RestApiPort = 0, the default) if not needed.

Technical details

The GET /api/v1/metrics/history REST endpoint fails to enforce domain confinement, allowing authenticated users with domain-scoped credentials (domain administrators, auditors with named domain lists, or domain-scoped API keys) to access server-wide traffic counters spanning all domains and all 30 days of history. The authorization gate does not refuse this route to confined credentials as it does for equivalent report routes, and the route handler receives no caller context. An attacker gains disclosure of aggregate server-wide operational counters (mail volume, spam counts) across tenant boundaries without gaining access to messages or accounts.

Affected products

Progressive Robot hMailServer 6.2.25 through 6.3.6

Timeline

2026-10-21: disclosed
2026-10-21: patched: Fixed in v6.3.7

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.