hMailServer CVE-2026-114490

Attacker must already possess an account assigned the serveradmin role WITH a domain list - a credential an administrator created specifically to confine that admin to named domains - and reach the COM administration API either through the Control Panel or a script executed on the server host. The flaw is that the COM server-administrator check reads administer_server as whole-server regardless of the attached domain list; a parallel domainadmin-with-list case, when the COM domain-administrator check is called with no domain, lets a domainadmin administer domains its list excludes (including ones outside its own domain). Limiting factors that reduce real-world risk: exploitation requires an already-provisioned (if confined) privileged credential and local/on-host COM access, it affects only versions 6.3.4 through 6.3.6, and an account holding serveradmin with NO list is the intended server administrator and is unaffected, as are the help desk, auditor and custom roles.

Signals are mixed and point to a credentialed privilege-escalation rather than a mass-exploitable bug. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N, C:H/I:H/A:H, base 7.8 HIGH) confirms local attack vector with low attacker privileges already required - the exploit presupposes an attacker who already holds a provisioned serveradmin credential that an administrator deliberately confined to a domain list, so this is a trust-boundary/delegation failure (CWE-863 Incorrect Authorization), effectively an insider or delegated-admin escalation, not a remote unauthenticated takeover. No EPSS score, KEV entry, SSVC decision data, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active or automatable exploitation; the absence of these signals, combined with AV:L and PR:L, argues this is a genuine-but-targeted integrity issue rather than a widespread-attack priority. Note the one tension worth verifying: the description says the confined credential 'signed in through the Control Panel' (which could sound network-facing) yet the official vector is AV:L and the realistic path is a script run on the server over the local COM API - treat exploitation as local/on-host, consistent with AV:L. Priority is moderate: patch promptly where delegated/confined admin accounts exist, but mass internet exploitation risk is low.

An administrator provisions a serveradmin account restricted to a specific domain list, intending to delegate limited administration. Because the COM server-administrator check reads administer_server as whole-server regardless of the domain list, that confined account signs in via the Control Panel or a local script and operates as full server administrator - reading and altering every domain's mail and accounts, rewriting server settings and secrets, and creating new server-admin accounts. No public exploit code is identified at time of analysis.