CVE-2026-107566

Missing authorization in the Sieve editheader action (6.2.22 through 6.3.6) and in the mail-rule Set header value action (6.0.0 through 6.3.6) of Progressive Robot hMailServer allows an authenticated user to make the server send mail as any address, DKIM-signed where the address is at a domain the server signs for. A Sieve script's editheader (addheader/deleteheader) could add or delete any header field except Received and Return-Path, and the server applies a script's header edits before it queues a redirect, so the redirected copy is sent as the script left it. The server signs a message's first delivery pass as the domain named in its From header wherever it signs DKIM for that domain and the message carries no signature of it. A script could therefore delete and re-add From - another account's address, or anyone's at a hosted domain - and redirect, so the server sent the message in that name and, for a hosted domain, signed it with that domain's DKIM key, a forgery aligned to pass the domain's DMARC; or, where another sender's domain is one the server signs for, delete the DKIM-Signature that sender's message arrived with, alter a field, and redirect, so the server re-signed the altered message as that sender's domain. editheader placed no restriction on From, Sender, Resent-From, Resent-Sender or DKIM-Signature. The editheader action was introduced in 6.2.22. In the mail-rule engine, a domain's or an account's rule's Set header value action could likewise set From, Sender, Resent-From, Resent-Sender or DKIM-Signature ahead of a forward or a copy, whoever the rule belonged to, so that an account acting on its own rules over COM, a domain administrator, or an API key confined to a domain (over the REST API from 6.3.4) could have the server forward or copy a message in the name of any address, signed, where that address is at a domain the server hosts with DKIM signing enabled, with that domain's key.

• CWE-862

• https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.7
• https://gitlab.com/hmailserver/hmailserver/-/work_items/83

Published

Oct 19, 2026

Last Modified

Oct 20, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-10753The Site Kit by Google WordPress plugin before 1.176.0 does…2.7
• CVE-2026-10754Pega Platform versions 8.5.0 through 25.1.2 are affected by …8.6
• CVE-2026-10755The All in One SEO WordPress plugin before 4.9.9 does not c…2.7
• CVE-2026-10756TRO600 contains a vulnerability that allows an authenticated…7.7
• CVE-2026-107564An unauthenticated remote attacker may use an allocation of …7.5
• CVE-2026-107565A flaw was found in luksmeta. A local attacker with administ…5.1
• CVE-2026-107567Use of a less trusted source in the DKIM signing of Progress…7.5
• CVE-2026-107568Missing authorization in the Sieve notify action (6.2.22 thr…6.5
• CVE-2026-107569Unchecked input for a loop condition in Progressive Robot hM…7.5
• CVE-2026-10757There is a SQL injection vulnerability in Esri ArcGIS Server…9.8
• CVE-2026-107570heap OOB write in convert_file_from_to() via a crafted Conte…2.5
• CVE-2026-107571Incorrect default permissions in the Windows installer of Pr…7.8