CVE-2026-114479

Not failing securely in the anti-virus attachment-stripping action of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have a message that the server's virus scanner found infected delivered to the recipient's mailbox unchanged. With virus scanning enabled and its action set to remove attachments and deliver the text (the default action deletes the message), the server keeps one text part of an infected message and replaces every attachment with a note. A message whose single part is not text - a program or an archive sent as the whole message, a message carried whole, a file declared an attachment, or an S/MIME message signed as one part, whose content the recipient's mail client opens - had no part the action could pick out, and was delivered as it arrived, with the content the scanner had found and nothing but a line in the application log to show it. Any sender can write such a message.

• CWE-636

• https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.7
• https://gitlab.com/hmailserver/hmailserver/-/work_items/92

Published

Oct 21, 2026

Last Modified

Oct 22, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-114473Incorrect authorization in the Sender Rewriting Scheme (SRS)…5
• CVE-2026-114474Use of a less trusted source for the envelope sender in the …5.9
• CVE-2026-114475Missing authorization in the REST role-management routes of …6.5
• CVE-2026-114476Incorrect authorization in the REST administration API of Pr…7.5
• CVE-2026-114477Missing authorization in the REST metrics route of Progressi…4.3
• CVE-2026-114478Insufficient preservation of the original sender in the forw…5.9
• CVE-2026-11448A weakness has been identified in GL.iNet GL-MT3000 up to 4.…5.1
• CVE-2026-114485Insufficient protection of sensitive information in the user…4.3
• CVE-2026-114486Incorrect authorization in the Devolutions Gateway token gen…4.3
• CVE-2026-114487Missing authorization in the PAM AD computer import endpoint…4.3
• CVE-2026-114488A flaw was found in Wildfly. A remote attacker can bypass au…7.4
• CVE-2026-114489Missing authorization in the REST and COM administration API…8.1