{"id":"CVE-2026-114475","summary":"Missing Authorization in hMailServer","details":"Missing authorization in the REST role-management routes of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows a remote authenticated user whose credential is confined to named domains to modify a custom role that accounts in other domains hold, and to create custom roles and delete any that no account holds. The routes that create, update and delete a custom role require the manage_roles permission, which only the serveradmin role holds; but a full-scope API key issued for named domains, and serveradmin assigned with a domain list, are serveradmin confined to those domains and hold manage_roles. The server's authorization gate did not refuse the three role routes to a confined credential and the route named no domain, so a credential issued to one tenant could raise or lower the permissions of a custom role assigned across other tenants - granting another domain's role every permission over its mailboxes and settings, or removing what it needs. A custom role may not hold administer_server, administer_domain or manage_roles, so the confined credential cannot make itself or another a server administrator by creating or rewriting a custom role.","modified":"2026-10-22T02:48:06.911892790Z","published":"2026-10-21T15:12:20.842Z","database_specific":{"cwe_ids":["CWE-862"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114475.json","cna_assigner":"GitLab"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114475.json"},{"type":"PACKAGE","url":"https://gitlab.com/hmailserver/hmailserver"},{"type":"WEB","url":"https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.7"},{"type":"WEB","url":"https://gitlab.com/hmailserver/hmailserver/-/work_items/89"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114475"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://gitlab.com/hmailserver/hmailserver","events":[{"introduced":"51e2dbda08d6aa7fcda5a48f1af05221809f78be"},{"last_affected":"e3c448aa66fc310b74d076884d54fae951296915"}],"database_specific":{"extracted_events":[{"strategy":"StandardRange","range":[{"introduced":"6.3.4"},{"last_affected":"6.3.6"}],"source":"AFFECTED_FIELD"}]}}],"versions":["v6.3.6","v6.3.5","v6.3.4"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-114475.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"}]}