PatchTheCVECVE-2026-114490: Incorrect authorization in the COM administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 all
28
Routine
HIGH 7.8
CVE-2026-114490 is a high-severity flaw (CVSS 7.8) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Incorrect authorization in the COM administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows an account assigned the serveradmin role with a list of domains - a credential an administrator may create meaning to confine it to those domains - to act as the whole-server administrator over COM. Administrator roles are meant to confine such a credential to the domains its list names, and the REST API did not take it for the server
Why this priority
- High severity
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 7.8 (High) |
| Attack vector | Local |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.1% (top 99%) |
| CISA exploited list | No |
| Weakness | CWE-863 |
| Published | 2026-10-21 |
| Last modified | 2026-10-22 |
Publisher (CNA): GitLab Inc.
Timeline
- Published CVE record published
- Updated Record last modified
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.