{"id":"CVE-2026-114478","aliases":[],"cve":{"records":[{"id":"CVE-2026-114478","source":"GitLab","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-21T15:11:45.854Z","published":"2026-10-21T15:12:35.847Z","modified":"2026-10-29T20:55:51.043Z"}],"publishers":[{"name":"GitLab","role":"CNA","organizationId":"ceab7361-8a18-47b1-92ba-4d7d25f6715a","modified":"2026-10-21T15:12:35.847Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-29T20:55:51.043Z"}],"references":[{"url":"https://gitlab.com/hmailserver/hmailserver/-/work_items/90","tags":[],"source":"GitLab"},{"url":"https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.7","tags":[],"source":"GitLab"}],"weaknesses":[{"id":"CWE-441","description":"CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')","source":"GitLab"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-29T17:33:39.332121Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Unintended Proxy or Intermediary ('Confused Deputy') in hMailServer","titleSource":"GitLab","descriptionSource":"GitLab","description":"Insufficient preservation of the original sender in the forwarding of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have mail they write, naming in its From an address at a domain the server hosts, delivered to other receivers as passing that domain's DMARC policy. When the server sent on a copy of mail that came from outside - an account's forward, a mail rule's forward, a Sieve redirect, a list's copy, or an alias or list expanding to an outside address - it could give the copy an SMTP identity in the organisation of the domain the copy's From names, whatever the message's origin: with the Sender Rewriting Scheme or the rewrite of the envelope sender on forwarding enabled (both off by default), an address at the forwarding domain; for a list, its bounce address; for a message with an empty envelope sender, none, under the server's own host name; and an envelope sender the message came with at a subdomain of a hosted domain was kept. Where that identity's SPF record authorises the server, other receivers' SPF check of the copy passed for a domain aligned with the From, and DMARC passed with it, although the message had not passed DMARC when the server received it. Exploitation needs a forward, redirect, alias or list that carries the hosted domain's mail to an outside address, and one of: SRS or the envelope rewrite enabled; a list whose bounce address is in the domain's organisation; an envelope sender at a subdomain whose SPF record authorises the server; or, for an empty envelope sender, an SPF record that authorises the server under its host name. The DKIM route to the same result is CVE-2026-107567.","score":5.9,"severity":"medium","published":"2026-10-21T15:12:35.847Z","modified":"2026-10-29T20:55:51.043Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Progressive Robot Ltd","name":"hMailServer","platforms":[],"versions":[{"version":"6.0.0","status":"affected","lessThanOrEqual":"6.3.6","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"GitLab","url":"https://www.cve.org/CVERecord?id=CVE-2026-114478"}],"remediation":[{"text":"Upgrade to hMailServer 6.3.7, in which a copy of mail from outside is sent on with an envelope sender, or under a host name, in the organisation of a domain its From names only when the message passed DMARC for that organisation when it arrived, a pass every copy of the message carries. Otherwise a forward, a Sieve redirect or a rule's forward keeps the envelope sender the message came with rather than an SRS or rewritten one; a copy whose identity would still be in that organisation - an empty envelope sender under a host name of it, or an envelope sender at the server's host name or in a hosted domain's organisation - is not sent to an outside address, nor is the message where an alias or a list expands to one; a managed list does not distribute the posting; and a distribution list's bounce address is not applied to it. Until then: keep SRS and the rewrite of the envelope sender on forwarding off where they are not needed; turn on the account option not to forward messages flagged as spam (ForwardAbortSpamFlagged) for accounts that forward to outside addresses, which does not hold a Sieve redirect; and set the DMARC test's score (DMARCFailureScore) at or above the spam delete threshold, so that a message that fails a published quarantine or reject policy is refused, or quarantined, on arrival. Neither of the last two holds mail in the name of a domain whose DMARC policy is none.","source":"GitLab","url":"https://www.cve.org/CVERecord?id=CVE-2026-114478"}],"references":["https://gitlab.com/hmailserver/hmailserver/-/work_items/90","https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.7"],"sources":[{"name":"CVE","id":"CVE-2026-114478","modified":"2026-10-29T20:55:51.043Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-114478"}],"assessments":[{"source":"GitLab","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","score":5.9}],"sourceAffected":[],"observedAt":"2026-10-29T21:32:23.698Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T03:10:30.875Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-30T01:45:32.866Z","attemptedAt":"2026-10-30T01:45:32.866Z"},{"source":"GHSA","status":"available","checkedAt":"2026-10-30T01:45:32.953Z","attemptedAt":"2026-10-30T01:45:32.953Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-30T01:45:32.891Z","attemptedAt":"2026-10-30T01:45:32.891Z"},{"source":"EPSS","status":"available","checkedAt":"2026-10-30T01:45:33.106Z","attemptedAt":"2026-10-30T01:45:33.106Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-114478","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114478","modified":"2026-10-29T21:17:12.313","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","checkedAt":"2026-10-30T01:45:32.866Z"},{"source":"ENISA EUVD","id":"EUVD-2026-107321","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-107321","modified":"Oct 29, 2026, 8:55:51 PM","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","checkedAt":"2026-10-30T01:45:32.891Z"},{"source":"GitHub Advisory Database","id":"GHSA-w852-m7j4-xm48","url":"https://github.com/advisories/GHSA-w852-m7j4-xm48","modified":"2026-10-21T18:33:22Z","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","checkedAt":"2026-10-30T01:45:32.953Z"},{"source":"FIRST EPSS","id":"CVE-2026-114478","url":"https://www.first.org/epss/","probability":0.00261,"percentile":0.17889,"date":"2026-10-29","checkedAt":"2026-10-30T01:45:33.106Z"}],"aiSummary":{"text":"hMailServer versions 6.0.0 through 6.3.6 have an 'Unintended Proxy or Intermediary' weakness, allowing remote unauthenticated attackers to bypass DMARC policies. Exploitation requires specific conditions, including forwarding or redirecting mail to an outside address. The impact is delivery of mail that would otherwise fail DMARC checks.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:41:14.747Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-114478"}]}}