hMailServer CVE-2026-107568

Requires an authenticated account on the target hMailServer that can store a Sieve script (via ManageSieve, the REST API self-service filter, or the administration interface) or create/act on mail rules (over COM, as a domain administrator, or via a domain-scoped REST API key from version 6.3.4). The Sieve notify path is only present in 6.2.22 through 6.3.6; the mail-rule Reply path affects 6.0.0 through 6.3.6. Any authenticated user can forge the From on mail that leaves the server; the maximal impact - DKIM-signed, DMARC-aligned forgery - additionally requires that the attacker-claimed From address be at a domain the server hosts with DKIM signing enabled. Limiting factors: valid credentials or an API key are mandatory (not remote-unauthenticated), and forgery of a non-hosted or DKIM-disabled domain yields an unsigned spoof that is far less likely to pass recipient DMARC checks. Fixed in 6.3.7.

This is a moderate-risk authorization flaw (CWE-862), not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, 6.5 Medium) correctly captures the shape: network-reachable, low complexity, but requiring an authenticated account (PR:L) and yielding pure integrity impact (I:H) with no confidentiality or availability loss. The real-world danger is email spoofing with cryptographic backing: because the server sets the notification/reply From header to the attacker-chosen :from and then DKIM-signs by that header's domain, an authenticated user can produce forged mail that is DKIM-signed and DMARC-aligned for ANY domain the server hosts - turning a low-privilege mailbox into a trusted phishing/BEC origin. That elevates practical impact above a typical 'spoof the From header' bug, since receiving systems will treat the mail as authenticated. Mitigating factors keep this below critical: exploitation requires valid credentials or an API key on the target server (PR:L, not PR:N), and maximal (DKIM-aligned) abuse requires the forged domain to be locally hosted with DKIM signing enabled. No EPSS score was provided, the CVE is NOT in CISA KEV, and no public exploit code was supplied in the intelligence - so there is no evidence of active or widespread exploitation. Net: a real priority for organizations running multi-tenant hMailServer with DKIM, a lower priority for single-user/no-DKIM deployments.

An attacker holding a low-privilege mailbox (or a domain-scoped API key) on a multi-tenant hMailServer stores a Sieve script whose notify action carries a :from of ceo@victim-domain.example, where that domain is hosted locally with DKIM enabled. When the notify fires, the server sends the message with that forged From and signs it with the victim domain's DKIM key, producing a DMARC-passing spoofed email ideal for business-email-compromise phishing. No public exploit code was identified in the provided intelligence; abuse requires only valid authenticated access and the ability to store a Sieve script or mail rule.