hMailServer EUVD-2026-107321

Requires an hMailServer (6.0.0-6.3.6) configuration that carries a hosted domain's mail to an outside address via an account forward, mail-rule forward, Sieve redirect, mailing-list copy, or an alias/list expanding externally. Additionally, at least one of these must hold: the Sender Rewriting Scheme or envelope-sender rewrite-on-forwarding is enabled (both OFF by default); a mailing list whose bounce address is within the hosted domain's organization; an inbound message with an envelope sender at a subdomain of a hosted domain whose SPF record authorizes the server; or a message with an empty envelope sender when the server's own hostname is SPF-authorized. Limiting factors: exploitation is impossible without such a forwarding/list path, the two most direct triggers (SRS and envelope rewrite) are disabled by default, and success depends on the server being SPF-authorized for the aligned identity - so default, non-forwarding deployments are not exploitable. The parallel DKIM-based variant is tracked as CVE-2026-107567.

This is a moderate, config-dependent email-authentication bypass rather than a high-urgency flaw. The provided CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N = 5.9) is internally consistent with the description: network-reachable and unauthenticated (PR:N), but with high attack complexity (AC:H) because exploitation depends on specific forwarding setups and one of several non-default conditions. Impact is integrity-only (I:H; C:N/A:N), reflecting message/sender-authenticity spoofing - not data theft. No EPSS score, KEV listing, or POC was provided, so there is no signal of active exploitation or automation; exploitation status is 'no public exploit identified at time of analysis.' The signals are coherent (no contradiction between vector and description), but note the 'Information Disclosure' tag conflicts with the CVSS C:N/I:H profile - this is a sender-spoofing / DMARC-bypass (confused-deputy, CWE-441) integrity issue, not a confidentiality one. Real-world priority is driven by whether an organization actually runs hMailServer 6.0.0-6.3.6 as a forwarding/list host with SRS, envelope rewrite, or the described list/subdomain/empty-sender conditions; absent those, the practical risk is low. Patch is confirmed available (v6.3.7).

An external attacker sends an email with a From: address at a domain hosted by the vulnerable hMailServer, aimed at a mailbox, list, alias, or rule that forwards or redirects to an outside recipient. When hMailServer relays the copy, it stamps a new SMTP envelope identity (e.g. an SRS-rewritten sender, the list bounce address, or the server's own hostname) that aligns with the spoofed From and is SPF-authorized, so the forwarded message passes SPF-based DMARC at downstream receivers even though it failed DMARC on arrival. No public exploit code was identified, but the attack requires no authentication and no victim interaction.