CVE-2026-114473
Last modified
CVE-2026-114473 is a medium-severity vulnerability rated 5/10 on the CVSS scale. Incorrect authorization in the Sender Rewriting Scheme (SRS) of Progressive Robot hMailServer 6.2.1 through 6.3.6 allows a remote attacker to relay mail through the server to outside addresses. With SRS enabled, the server rewrites the envelope sender of mail it forwards to a signed SRS address at the forwarding domain, and passes a bounce to that address back to the original sender; but it took every message to a valid SRS address, whatever its sender, as delivery to a local recipient, so the relay rules and the SMTP authentication they require were not applied, and the message was delivered to the outside address the SRS address encodes. EPSS estimates a 0.24% chance of exploitation in the next 30 days.
Description
Incorrect authorization in the Sender Rewriting Scheme (SRS) of Progressive Robot hMailServer 6.2.1 through 6.3.6 allows a remote attacker to relay mail through the server to outside addresses. With SRS enabled, the server rewrites the envelope sender of mail it forwards to a signed SRS address at the forwarding domain, and passes a bounce to that address back to the original sender; but it took every message to a valid SRS address, whatever its sender, as delivery to a local recipient, so the relay rules and the SMTP authentication they require were not applied, and the message was delivered to the outside address the SRS address encodes. Anyone holding a valid SRS address of the server, such as the recipient of a forwarded message, could have the server relay mail to the address it encodes for 21 days, and an account holder whose account forwards to an outside mailbox could obtain one for any address. SRS is off by default.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Progressive Robot Ltd | hMailServer | >= 6.2.1, <= 6.3.6 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-114473?
How severe is CVE-2026-114473?
How do I fix CVE-2026-114473?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-114462Improper link resolution before file access ('link following…6
- CVE-2026-114463The webhook platform gateway in Nous Research Hermes Agent v…7.5
- CVE-2026-11447A security flaw has been discovered in GL.iNet GL-MT3000 up …6.3
- CVE-2026-114470Cross-site request forgery in the REST API of Progressive Ro…5.3
- CVE-2026-114471Insertion of sensitive information into a log file in the SM…4.7
- CVE-2026-114472Insufficient resource pool in the ACME HTTP-01 challenge res…3.7
- CVE-2026-114474Use of a less trusted source for the envelope sender in the …5.9
- CVE-2026-114475Missing authorization in the REST role-management routes of …6.5
- CVE-2026-114476Incorrect authorization in the REST administration API of Pr…7.5
- CVE-2026-114477Missing authorization in the REST metrics route of Progressi…4.3
- CVE-2026-114478Insufficient preservation of the original sender in the forw…5.9
- CVE-2026-114479Not failing securely in the anti-virus attachment-stripping …5.8
Are you affected by CVE-2026-114473?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST