{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "hMailServer",
          "repo": "https://gitlab.com/hmailserver/hmailserver",
          "vendor": "Progressive Robot Ltd",
          "versions": [
            {
              "lessThanOrEqual": "6.3.6",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Found in the hMailServer project\u0027s own security review (Progressive Robot Ltd)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Missing authorization in the Sieve editheader action (6.2.22 through 6.3.6) and in the mail-rule Set header value action (6.0.0 through 6.3.6) of Progressive Robot hMailServer allows an authenticated user to make the server send mail as any address, DKIM-signed where the address is at a domain the server signs for. A Sieve script\u0027s editheader (addheader/deleteheader) could add or delete any header field except Received and Return-Path, and the server applies a script\u0027s header edits before it queues a redirect, so the redirected copy is sent as the script left it. The server signs a message\u0027s first delivery pass as the domain named in its From header wherever it signs DKIM for that domain and the message carries no signature of it. A script could therefore delete and re-add From - another account\u0027s address, or anyone\u0027s at a hosted domain - and redirect, so the server sent the message in that name and, for a hosted domain, signed it with that domain\u0027s DKIM key, a forgery aligned to pass the domain\u0027s DMARC; or, where another sender\u0027s domain is one the server signs for, delete the DKIM-Signature that sender\u0027s message arrived with, alter a field, and redirect, so the server re-signed the altered message as that sender\u0027s domain. editheader placed no restriction on From, Sender, Resent-From, Resent-Sender or DKIM-Signature. The editheader action was introduced in 6.2.22. In the mail-rule engine, a domain\u0027s or an account\u0027s rule\u0027s Set header value action could likewise set From, Sender, Resent-From, Resent-Sender or DKIM-Signature ahead of a forward or a copy, whoever the rule belonged to, so that an account acting on its own rules over COM, a domain administrator, or an API key confined to a domain (over the REST API from 6.3.4) could have the server forward or copy a message in the name of any address, signed, where that address is at a domain the server hosts with DKIM signing enabled, with that domain\u0027s key."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T15:34:27.491Z",
        "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
        "shortName": "GitLab"
      },
      "references": [
        {
          "url": "https://gitlab.com/hmailserver/hmailserver/-/work_items/83"
        },
        {
          "url": "https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.7"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to hMailServer 6.3.7, which refuses a Sieve script that adds or deletes From, Sender, Resent-From, Resent-Sender or DKIM-Signature when the script is stored, and does not make such an edit at delivery for a script stored earlier (logged), while leaving Reply-To and other fields editable; and which lets only a server rule\u0027s Set header value action, which only the server administrator saves, set those five fields, refusing an account\u0027s or a domain\u0027s rule that sets one when it is saved and not setting it at delivery for one stored before (logged). Until then, where accounts need not set Sieve scripts, close the script surfaces: keep ManageSieve off (ManageSieveServerPort=0, the default) or bound to the loopback, and turn the REST API off where the webmail\u0027s filter editor is not wanted (RestApiPort=0, the default); and review active Sieve scripts for an addheader or deleteheader of From, Sender, Resent-From, Resent-Sender or DKIM-Signature followed by a redirect, and account and domain rules for a Set header value of one of those fields. There is no per-extension setting that turns editheader off while Sieve is in use."
        }
      ],
      "title": "Missing Authorization in hMailServer"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
    "assignerShortName": "GitLab",
    "cveId": "CVE-2026-107566",
    "datePublished": "2026-10-19T15:34:27.491Z",
    "dateReserved": "2026-10-08T10:50:55.763Z",
    "dateUpdated": "2026-10-19T15:34:27.491Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}