hMailServer CVE-2026-114470

Exploitation requires that the victim be an hMailServer administrator who previously authenticated to the REST API via its HTTP Basic sign-in box, so the browser has cached and will auto-send that Basic credential to the API origin. The victim must then visit an attacker-controlled page (UI:R) that issues a top-level cross-site form post; the server reads the request body regardless of declared content type, and the CSRF defenses (header check plus SameSite=Strict cookie) protected only the cookie session, not Basic auth. Limiting factors: the attack fails if no live cached Basic credential exists (e.g., the admin never used the box or the browser dropped it), if the admin is not lured to the hostile page, and it is blind (C:N) - the attacker cannot read responses, only trigger state changes. Fixed in version 6.3.7.

This is a medium-severity CSRF (CWE-352) with a self-consistent CVSS 3.1 vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N, 5.3) whose signals point to a conditional, not widespread, risk. AV:N reflects that the attacker-controlled page is delivered over the network, but AC:H and UI:R are the dominant limiters: exploitation depends on a specific victim state (an administrator whose browser already holds a cached HTTP Basic credential for the REST API from a prior sign-in box) actively visiting attacker content. PR:N is correct in the CSRF sense - the attacker holds no privileges and rides the victim's cached credential. Impact is C:N/I:H/A:N, which matches the blind-forgery description: the attacker cannot read the cross-origin response (C:N) but can drive high-impact state changes such as creating domains, accounts, or API keys (I:H). No EPSS score, KEV listing, or POC was provided; therefore there is no public exploit identified at time of analysis and no evidence of active exploitation. This is a legitimate hardening fix rather than an urgent emergency: real-world risk is gated on an administrator holding a live cached Basic credential and being socially engineered to a hostile page. Prioritize patching to v6.3.7 on a normal cycle; the lack of EPSS/KEV/POC signals is consistent with a low-urgency, non-widespread issue rather than conflicting with the CVSS score.

An attacker lures an hMailServer administrator - whose browser still holds a cached HTTP Basic credential for the REST API from an earlier sign-in - to a web page under the attacker's control. The page auto-submits a top-level cross-site form post to the REST API, which the browser decorates with the cached Basic credential and the server processes regardless of the declared content type, silently creating an account or API key. No public exploit code is identified at time of analysis, and because the attacker cannot read the response the forgery is blind.