PatchTheCVECVE-2026-114475: Missing authorization in the REST role-management routes of Progressive Robot hMailServer 6.3.4 through 6.3.6
26
Routine
MEDIUM 6.5
CVE-2026-114475 is a medium-severity flaw (CVSS 6.5) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Missing authorization in the REST role-management routes of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows a remote authenticated user whose credential is confined to named domains to modify a custom role that accounts in other domains hold, and to create custom roles and delete any that no account holds. The routes that create, update and delete a custom role require the manage_roles permission, which only the serveradmin role holds; b
Why this priority
- No elevated risk signals yet
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 6.5 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.2% (top 86%) |
| CISA exploited list | No |
| Weakness | CWE-862 |
| Published | 2026-10-21 |
| Last modified | 2026-10-22 |
Publisher (CNA): GitLab Inc.
Timeline
- Published CVE record published
- Updated Record last modified
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.