hMailServer CVE-2026-114489

Requires a multi-tenant hMailServer 6.0.0 through 6.3.6 instance that hosts multiple named domains, and the attacker must already possess a valid credential confined to named domains - specifically a domain administrator account, an account or API key granted a role that manages accounts in named domains, or a full-scope API key issued for named domains. The REST path lets such a confined caller create arbitrary domain aliases, rename domains to names the server does not host, set rule bind-to-address/send-using-route/script-function actions, or set a domain relay host; the COM path additionally lets any account set those three rule actions on its own rules, with the script-function action executing at delivery, and the COM domain-alias save performs no authorization check at all. Limiting factors: exploitation is NOT unauthenticated (a confined credential is a prerequisite), the impact is meaningful only on genuinely multi-tenant servers (single-domain installs have little to divert), and the COM vector requires local COM access to the server rather than remote network reach.

This is a genuine cross-tenant authorization failure (CWE-862) rather than an inflated high-CVSS score, but its real-world urgency is conditional. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, 8.1) indicates network-reachable, low-complexity exploitation that requires authenticated privileges (PR:L) - consistent with the description, which states the attacker must already hold a credential confined to named domains (a domain administrator, an account/API-key role that manages accounts, or a full-scope API key). So this is an authenticated privilege-escalation/tenant-isolation break, not a pre-auth compromise. No EPSS score, no CISA KEV listing, and no public exploit were provided, so exploitation status is: no public exploit identified at time of analysis. There is no SSVC decision data supplied. The high confidentiality and integrity impact is credible because a confined caller can divert other tenants' mail, read stored route credentials, and reach the server's event script. Net: a real priority specifically for multi-tenant/hosting deployments of hMailServer, lower priority for single-domain installs. One caveat to verify: the official vector rates A:N, yet the description explicitly says other tenants' mail can be 'denied,' which is an availability impact - the input may understate availability.

On a shared multi-tenant hMailServer, an attacker holding a domain-scoped administrator account or a named-domain API key calls the REST (or COM) administration API and creates a domain alias matching another tenant's domain, silently diverting that tenant's inbound mail to an attacker-controlled address - or sets a mail rule's script-function/send-using-route action to reach the server's own stored route credentials and event script. No public exploit was identified at time of analysis, but exploitation needs only a valid confined credential and the documented API calls.