Missing authorization in the REST role-management routes of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows a remote authenticated user whose credential is confined to named domains to modify a custom role that accounts in other domains hold, and to create custom roles and delete any that no account holds. The routes that create, update and delete a custom role require the manage_roles permission, which only the serveradmin role holds; but a full-scope API key issued for named domains, and serveradmin assigned with a domain list, are serveradmin confined to those domains and hold manage_roles. The server's authorization gate did not refuse the three role routes to a confined credential and the route named no domain, so a credential issued to one tenant could raise or lower the permissions of a custom role assigned across other tenants - granting another domain's role every permission over its mailboxes and settings, or removing what it needs. A custom role may not hold administer_server, administer_domain or manage_roles, so the confined credential cannot make itself or another a server administrator by creating or rewriting a custom role.
References
Configurations
No configuration.
History
21 Oct 2026, 16:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-10-21 16:17
Updated : 2026-10-29 21:17
NVD link : CVE-2026-114475
Mitre link : CVE-2026-114475
CVE.ORG link : CVE-2026-114475
JSON object : View
Products Affected
No product.
CWE
CWE-862
Missing Authorization