Incorrect authorization in hMailServer lets attackers relay mail
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-863.
Summary
hMailServer versions 6.2.1 through 6.3.6 contain an incorrect authorization flaw (CWE-863) in the Sender Rewriting Scheme (SRS). The server treats any message sent to a valid SRS address as local delivery, so relay rules and SMTP authentication are skipped. A remote attacker holding a valid SRS address of the server can relay mail through it to the outside address that the SRS address encodes. SRS is off by default.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
Incorrect authorization in the Sender Rewriting Scheme (SRS) of Progressive Robot hMailServer 6.2.1 through 6.3.6 allows a remote attacker to relay mail through the server to outside addresses. With SRS enabled, the server rewrites the envelope sender of mail it forwards to a signed SRS address at the forwarding domain, and passes a bounce to that address back to the original sender; but it took every message to a valid SRS address, whatever its sender, as delivery to a local recipient, so the relay rules and the SMTP authentication they require were not applied, and the message was delivered to the outside address the SRS address encodes. Anyone holding a valid SRS address of the server, such as the recipient of a forwarded message, could have the server relay mail to the address it encodes for 21 days, and an account holder whose account forwards to an outside mailbox could obtain one for any address. SRS is off by default.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Progressive Robot Ltd | hMailServer | 6.2.1 – 6.3.6 | — | No fix listed | CNA |
- hMailServer VendorProgressive Robot Ltd Affected 6.2.1 – 6.3.6 Fixed in — No fix listed CNA
Remediation
The sources list no fixed version for hMailServer.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Timeline
- 2026-10-21 Threatist record created from CVE-2026-114473
- 2026-10-21 Alias added: GHSA-mvr2-pg72-p566
- 2026-10-29 CISA SSVC decision points changed
References
More Progressive Robot Ltd vulnerabilities
- TI-2026-64884 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in hMailServer CVSS 3.1CRITICAL 9.8
- TI-2026-76418 Unchecked loop limit in hMailServer lets remote attackers stop mail CVSS 3.1HIGH 7.5
- TI-2026-69567 Inefficient processing in hMailServer stalls mail delivery CVSS 3.1HIGH 7.5
- TI-2026-69565 Infinite loop in hMailServer MIME handling lets attackers stop mail CVSS 3.1HIGH 7.5
- TI-2026-69564 Inefficient DKIM and ARC checks in hMailServer cause denial of service CVSS 3.1HIGH 7.5
- TI-2026-69562 Inefficient JSON parsing in hMailServer lets attackers halt mail CVSS 3.1HIGH 7.5
Sources
- CVE-2026-114473 · CVE Program
- CVE-2026-114473 · NVD
- FIRST EPSS
- GHSA-mvr2-pg72-p566 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences