CVE-2026-114490

🎯 CVE-2026-114490 🇪🇺 EUVD

💬 0 Diskussion 📄 .md Alle CVEs anzeigen ✕

CVE-2026-114490 | Incorrect authorization in the COM administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows an account assigned the serveradmin role with a list of domains - a credential an administrator may create meaning to confine it to those domains - to act as the whole-server administrator over COM. Administrator roles are meant to confine such a credential to the domains its list names, and the REST API did not take it for the server administrat

Incorrect authorization in the COM administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows an account assigned the serveradmin role with a list of domains - a credential an administrator may create meaning to confine it to those domains - to act as the whole-server administrator over COM. Administrator roles are meant to confine such a credential to the domains its list names, and the REST API did not take it for the server administrator, but the COM API's server-administrator check read the administer_server permission as the whole server whatever list the grant carried. So the credential signed in through the Control Panel, or through a script run on the server, as the server administrator of every domain: it could read and change every domain's accounts and mail, rename any domain, map a domain alias onto any, write the server's settings and secrets, and create further server-administrator accounts. The COM API's domain-administrator check, asked with no domain, likewise let an account assigned the domainadmin role with a list of domains that leaves out the account's own domain administer that domain's ordinary accounts over COM. An account holding serveradmin with no list is the server administrator by design and is unaffected, as are the help desk, auditor and custom roles.

Klassifikation & Betroffenheit:

CWE-863 Progressive Robot Ltd hMailServer 6.3.4 ≤6.3.6

Incorrect Authorization 🎯 High

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

🛡️ Empfohlene Mitigation: Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal…

Vollständige Definition bei MITRE ➔

🧩 Ähnliche Schwachstellen (Hersteller/Klasse/Score-Band):

CVE-2026-112776 9.3 CVE-2026-109587 9.3 CVE-2026-19863 9.3 CVE-2026-105851 9.3 CVE-2026-86102 9.3

📚 Referenzen & Quellen:

🇪🇺 Original-Eintrag (ENISA EUVD) 🇺🇸 NVD-Eintrag

Ausnutzungs-Zeitleiste:

Reserviert 2026

Veröffentlicht 10/2026

Heute 05.11.

CVSS-Vektor-Analyse: 7.8

AV · Angriffsvektor Lokal

AC · Komplexität Gering

PR · Privilegien Gering

UI · Interaktion Keine

S · Scope Unverändert

C · Vertraulichkeit Hoch

I · Integrität Hoch

A · Verfügbarkeit Hoch

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CNA-Bewertung (GitLab): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Veröffentlicht:21.10.2026

Aktualisiert:29.10.2026 21:17

Assigner (CNA):GitLab

EUVD-ID:EUVD-2026-107329

Quellen: 🇪🇺 EUVD-Datenbank (ENISA) + 🇺🇸 NVD-Anreicherung · 24-h-Cache

CWE-863 ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

Tier	CVEs	Anteil
≥90 %	786	0,2 %
≥50 %	3.570	0,9 %
≥10 %	23.060	5,7 %
<10 %	380.695	93,3 %

Tier

CVEs

Anteil

≥90 %

786

0,2 %

≥50 %

3.570

0,9 %

≥10 %

23.060

5,7 %

<10 %

380.695

93,3 %

7.8 HIGH

EPSS

0.1%

CVE-2026-114490 💻 Lokal 🔑 Geringe Nutzerrechte nötig

Progressive Robot Ltd

CVE-2026-114490 | Incorrect authorization in the COM administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows an account assigned the serveradmin role with a list of domains - a credential an administrator may create meaning to confine it to those domains - to act as the whole-server administrator over COM. Administrator roles are meant to confine such a credential to the domains its list names, and the REST API did not take it for the server administrat

CWE-863 ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

vor 15 Tagen

🛡️ Details ➔

Zero-Day & Vulnerability Intelligence Hub