https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 22 Oct 2026 02:39:18 +0000 https://db.gcve.eu/vuln/cve-2026-114489 <p><strong>Affected:</strong> Progressive Robot Ltd hMailServer</p> <p>Missing authorization in the REST and COM administration APIs of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote authenticated user whose credential is confined to named domains to change mail routing and domain configuration beyond those domains on a multi-tenant server. A domain administrator, an account or API key given another role that manages accounts in named domains, or a full-scope API key issued for named domains could create a domain alias for any name (so that other tenants&#39; mail for that name is diverted to an address the attacker controls, or denied), rename a domain to any name the server does not host, set a rule&#39;s bind-to-address, send-using-route or script-function action to reach one of the server&#39;s own addresses, a configured route&#39;s stored credentials or a function of the server&#39;s event script, and set the domain&#39;s relay host - which delivery then connects to with no address rule - to an address on the server&#39;s own network; and over the COM API any account could set the three rule actions on its own rules, where the script-function action runs at delivery. The authorization gate did not refuse these routes to a confined credential and the handlers were not given the caller; over COM the domain-alias save performed no authorization check at all, the domain rename required only a domain administrator, and a rule save required at most that the caller could change the rule&#39;s owner.</p> <p><strong>Affected:</strong> Progressive Robot Ltd hMailServer</p> <p>Missing authorization in the REST and COM administration APIs of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote authenticated user whose credential is confined to named domains to change mail routing and domain configuration beyond those domains on a multi-tenant server. A domain administrator, an account or API key given another role that manages accounts in named domains, or a full-scope API key issued for named domains could create a domain alias for any name (so that other tenants&#39; mail for that name is diverted to an address the attacker controls, or denied), rename a domain to any name the server does not host, set a rule&#39;s bind-to-address, send-using-route or script-function action to reach one of the server&#39;s own addresses, a configured route&#39;s stored credentials or a function of the server&#39;s event script, and set the domain&#39;s relay host - which delivery then connects to with no address rule - to an address on the server&#39;s own network; and over the COM API any account could set the three rule actions on its own rules, where the script-function action runs at delivery. The authorization gate did not refuse these routes to a confined credential and the handlers were not given the caller; over COM the domain-alias save performed no authorization check at all, the domain rename required only a domain administrator, and a rule save required at most that the caller could change the rule&#39;s owner.</p> https://db.gcve.eu/vuln/cve-2026-114489