hMailServer EUVD-2026-107320

Requires a valid, already-authenticated credential that is CONFINED to named domains - specifically a domain administrator, an account with a role holding view_configuration scoped to named domains (e.g. the auditor role given a domain list), or an API key issued for named domains - plus network reachability of the REST API endpoint GET /api/v1/metrics/history. The flaw is that the metrics route was omitted from the server's authorization gate and its handler was never given the caller, so the confinement the report routes enforce does not apply here. Limiting factors: exploitation is impossible without a provisioned confined credential (PR:L, not unauthenticated), there is no user-interaction or propagation vector, and the disclosure is bounded to aggregate server-wide traffic counters over the last 30 days - no message content, account data, or configuration beyond those counters is exposed.

This is a low-to-moderate priority information-disclosure issue, not an urgent threat. The CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/C:L/I:N/A:N) reflects a network-reachable but authenticated flaw with only limited confidentiality impact and no integrity or availability effect. No EPSS probability was supplied in the input, there is no CISA KEV listing (not confirmed actively exploited), and no public exploit code was identified - so all three exploitation signals point low and none contradict the modest CVSS. The SSVC-style read is: exploitation = none observed, automatable = likely no (requires a pre-provisioned confined credential and offers no propagation), technical impact = partial. The signals are consistent rather than conflicting: a genuine authorization gap (CWE-862) that leaks only aggregate, server-wide traffic counters - not messages, credentials, or account data - to a caller who already holds a valid (if domain-confined) credential. The realistic consequence is an authenticated domain administrator or auditor learning the whole server's 30-day traffic totals instead of just their own domains', a tenant-isolation / least-privilege violation of operational metadata rather than a path to compromise.

A multi-tenant hMailServer host issues a domain administrator (or an auditor-role account or API key) a credential scoped to only certain named domains. That user authenticates to the REST API and issues GET /api/v1/metrics/history, receiving the server's aggregate 30-day traffic counters across all domains rather than being refused as the report routes would refuse them. No public exploit code is identified at time of analysis; exploitation is a single authenticated API call with low attack complexity (AC:L).