hMailServer CVE-2026-114476

Exploitation requires an authenticated credential that holds the manage_roles permission in named domains - specifically a full-scope API key issued for those domains, or an account assigned the serveradmin role scoped to a domain list. The target must be an account within those domains whose base admin level is server administrator but is currently narrowed by an assigned role, and the attacker must be able to set that target account's password while the narrowing role is still assigned. The flaw is in DELETE /api/v1/role-assignments/{address}, which validates only the authority the account holds at request time, not the elevated authority it would hold after the role is removed. Limiting factors: a pre-existing privileged (though domain-scoped) credential is mandatory, the attack is network-facing but only against hMailServer 6.3.4-6.3.6 exposing the REST administration API, and CVSS AC:H reflects the multi-step password-set-then-role-removal sequence required.

This is a genuine but conditionally-gated privilege-escalation issue rather than a trivially exploitable one. The provided CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.5) is internally consistent with the description: it is network-reachable (REST API), requires an already-authenticated low-privilege credential (PR:L - a domain-scoped manage_roles API key or a serveradmin-with-domain-list account), and carries high complexity (AC:H) because the attacker must have set the target account's password while it held the narrowing role and then abuse the DELETE role-assignment check. There is no EPSS score, no CISA KEV listing, and no public POC in the supplied data - so by the precision rules this is 'no public exploit identified at time of analysis.' The absence of KEV/EPSS signals, combined with AC:H and the requirement for a pre-existing privileged (if domain-scoped) credential, points to a targeted, insider-or-compromised-credential threat model rather than mass automated exploitation. The high impact (full server-administrator takeover) keeps this a real patch priority for any exposed hMailServer 6.3.4-6.3.6 instance, but the preconditions mean it is not an opportunistic internet-wide risk. Confidence is limited by thin sourcing: only a GitLab-hosted vendor work item and the v6.3.7 release note are provided, with no NVD-enriched EPSS or independent exploit confirmation.

An attacker already holding a domain-scoped manage_roles credential (a full-scope API key for its domains, or a serveradmin account restricted to a domain list) targets an in-domain account whose underlying admin level is server administrator but which is deliberately narrowed by an assigned role. The attacker first sets that account's password while the narrowing role is in place, then calls DELETE /api/v1/role-assignments/{address} to strip the role - restoring the account to full server-administrator authority - and logs in with the password they set. No public exploit code is identified at time of analysis.