https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 20 Oct 2026 23:52:26 +0000 https://db.gcve.eu/vuln/cve-2026-107566 <p><strong>Affected:</strong> Progressive Robot Ltd hMailServer</p> <p>Missing authorization in the Sieve editheader action (6.2.22 through 6.3.6) and in the mail-rule Set header value action (6.0.0 through 6.3.6) of Progressive Robot hMailServer allows an authenticated user to make the server send mail as any address, DKIM-signed where the address is at a domain the server signs for. A Sieve script&#39;s editheader (addheader/deleteheader) could add or delete any header field except Received and Return-Path, and the server applies a script&#39;s header edits before it queues a redirect, so the redirected copy is sent as the script left it. The server signs a message&#39;s first delivery pass as the domain named in its From header wherever it signs DKIM for that domain and the message carries no signature of it. A script could therefore delete and re-add From - another account&#39;s address, or anyone&#39;s at a hosted domain - and redirect, so the server sent the message in that name and, for a hosted domain, signed it with that domain&#39;s DKIM key, a forgery aligned to pass the domain&#39;s DMARC; or, where another sender&#39;s domain is one the server signs for, delete the DKIM-Signature that sender&#39;s message arrived with, alter a field, and redirect, so the server re-signed the altered message as that sender&#39;s domain. editheader placed no restriction on From, Sender, Resent-From, Resent-Sender or DKIM-Signature. The editheader action was introduced in 6.2.22. In the mail-rule engine, a domain&#39;s or an account&#39;s rule&#39;s Set header value action could likewise set From, Send…</p> <p><strong>Affected:</strong> Progressive Robot Ltd hMailServer</p> <p>Missing authorization in the Sieve editheader action (6.2.22 through 6.3.6) and in the mail-rule Set header value action (6.0.0 through 6.3.6) of Progressive Robot hMailServer allows an authenticated user to make the server send mail as any address, DKIM-signed where the address is at a domain the server signs for. A Sieve script&#39;s editheader (addheader/deleteheader) could add or delete any header field except Received and Return-Path, and the server applies a script&#39;s header edits before it queues a redirect, so the redirected copy is sent as the script left it. The server signs a message&#39;s first delivery pass as the domain named in its From header wherever it signs DKIM for that domain and the message carries no signature of it. A script could therefore delete and re-add From - another account&#39;s address, or anyone&#39;s at a hosted domain - and redirect, so the server sent the message in that name and, for a hosted domain, signed it with that domain&#39;s DKIM key, a forgery aligned to pass the domain&#39;s DMARC; or, where another sender&#39;s domain is one the server signs for, delete the DKIM-Signature that sender&#39;s message arrived with, alter a field, and redirect, so the server re-signed the altered message as that sender&#39;s domain. editheader placed no restriction on From, Sender, Resent-From, Resent-Sender or DKIM-Signature. The editheader action was introduced in 6.2.22. In the mail-rule engine, a domain&#39;s or an account&#39;s rule&#39;s Set header value action could likewise set From, Send…</p> https://db.gcve.eu/vuln/cve-2026-107566