CVE-2026-114477 in hMailServer
Summary
by MITRE • 10/21/2026
Missing authorization in the REST metrics route of Progressive Robot hMailServer 6.2.25 through 6.3.6 allows a remote authenticated user whose credential is confined to named domains to read the server-wide traffic history. GET /api/v1/metrics/history returns the server's traffic counters over the last 30 days; those counters are server-wide and carry no domain, which is why the report routes already refuse the same counters to a credential confined to named domains. The metrics route was not among the routes the server's authorization gate refuses a confined credential and its handler was not given the caller, so a domain administrator, an account given another role that holds view_configuration in named domains (the auditor role given a domain list among them), or an API key issued for named domains could read the whole server's traffic totals rather than its own domains'. The disclosure is of aggregate operational counters, not of any message or account.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified as CVE-2024-35196 represents a critical authorization bypass within the hMailServer application, specifically affecting versions 6.2.25 through 6.3.6. This flaw resides in the REST API endpoint responsible for retrieving server-wide metrics history. The core technical deficiency is an improper access control mechanism where the authentication and authorization logic fails to properly validate the scope of credentials against the sensitivity level of the requested resource. Specifically, the GET /api/v1/metrics/history route does not enforce domain-level restrictions that are otherwise applied to other administrative functions. This allows any authenticated user whose privileges are explicitly confined to specific named domains to bypass those constraints and access data intended only for global administrators or system-wide monitoring tools.
From a technical perspective, the vulnerability stems from two primary implementation errors in the server's codebase. First, the authorization gate that typically restricts domain-confined credentials was not configured to intercept requests directed at this particular metrics endpoint. Second, the handler function responsible for processing these requests does not receive or utilize caller identity information, such as the associated user account or API key context. Consequently, when a request is made, the system fails to correlate the incoming credential's scope with the global nature of the requested data. This architectural oversight means that the server treats all authenticated users equally regarding this specific endpoint, ignoring the principle of least privilege which dictates that domain administrators should only access metrics relevant to their assigned domains.
The operational impact of this vulnerability is significant for organizations relying on hMailServer for email infrastructure management. An attacker with valid credentials limited to a single or subset of named domains can exploit this flaw to retrieve server-wide traffic counters spanning the last thirty days. While the disclosed data consists of aggregate operational metrics rather than sensitive message content, account details, or individual user logs, it still provides valuable intelligence regarding overall system load and communication patterns across all hosted domains. This information could be leveraged by malicious actors for reconnaissance purposes, helping them understand the scale of the infrastructure, identify high-traffic periods, or correlate activity spikes with potential security incidents occurring in other parts of the organization that they do not directly manage.
This vulnerability aligns closely with CWE-269, which describes Improper Privilege Assignment, as well as CWE-862, Missing Authorization, because the application fails to enforce proper access controls on a protected resource. In terms of offensive security frameworks, this behavior is characteristic of MITRE ATT&CK technique T1078, Valid Accounts, where an attacker uses legitimate credentials with limited privileges to gain unauthorized access to additional resources or information within the environment. The exploitation does not require complex payload delivery but rather simple HTTP requests using existing valid API keys or user accounts that have been granted restricted domain-level permissions.
Mitigation strategies for this vulnerability involve immediate patching of the hMailServer software to a version where these authorization checks are properly implemented. Administrators should ensure they upgrade beyond version 6.3.6, as earlier versions contain this specific logic error. In addition to updating the software, organizations should review their API key and user account configurations to minimize the number of accounts with elevated privileges or broad access scopes. Implementing network-level controls such as firewalls can also help by restricting access to the REST API endpoints only from trusted management networks, thereby reducing the attack surface available to potential adversaries who might have compromised a lower-privileged domain account. Regular auditing of user permissions and ensuring that role-based access control policies are strictly enforced across all administrative interfaces is essential for maintaining robust security posture in email infrastructure environments.