https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 05 Nov 2026 12:33:13 +0000 https://db.gcve.eu/vuln/cve-2026-114490 <p><strong>Affected:</strong> Progressive Robot Ltd hMailServer</p> <p>Incorrect authorization in the COM administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows an account assigned the serveradmin role with a list of domains - a credential an administrator may create meaning to confine it to those domains - to act as the whole-server administrator over COM. Administrator roles are meant to confine such a credential to the domains its list names, and the REST API did not take it for the server administrator, but the COM API&#39;s server-administrator check read the administer_server permission as the whole server whatever list the grant carried. So the credential signed in through the Control Panel, or through a script run on the server, as the server administrator of every domain: it could read and change every domain&#39;s accounts and mail, rename any domain, map a domain alias onto any, write the server&#39;s settings and secrets, and create further server-administrator accounts. The COM API&#39;s domain-administrator check, asked with no domain, likewise let an account assigned the domainadmin role with a list of domains that leaves out the account&#39;s own domain administer that domain&#39;s ordinary accounts over COM. An account holding serveradmin with no list is the server administrator by design and is unaffected, as are the help desk, auditor and custom roles.</p> <p><strong>Affected:</strong> Progressive Robot Ltd hMailServer</p> <p>Incorrect authorization in the COM administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows an account assigned the serveradmin role with a list of domains - a credential an administrator may create meaning to confine it to those domains - to act as the whole-server administrator over COM. Administrator roles are meant to confine such a credential to the domains its list names, and the REST API did not take it for the server administrator, but the COM API&#39;s server-administrator check read the administer_server permission as the whole server whatever list the grant carried. So the credential signed in through the Control Panel, or through a script run on the server, as the server administrator of every domain: it could read and change every domain&#39;s accounts and mail, rename any domain, map a domain alias onto any, write the server&#39;s settings and secrets, and create further server-administrator accounts. The COM API&#39;s domain-administrator check, asked with no domain, likewise let an account assigned the domainadmin role with a list of domains that leaves out the account&#39;s own domain administer that domain&#39;s ordinary accounts over COM. An account holding serveradmin with no list is the server administrator by design and is unaffected, as are the help desk, auditor and custom roles.</p> https://db.gcve.eu/vuln/cve-2026-114490