CVE-2026-107566: hMailServer 6.0.0 through 6.3.6

Affected technology

hMailServer · 6.0.0 through 6.3.6
Progressive Robot Ltd

Description’s affected range: through 6.3.6) and in the mail-rule Set header value action (6.0.0 through 6.3.6) of Progressive Robot hMailServer allows an authenticated user to make the server send mail as any address

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

An authenticated user can make the server send mail as any address, DKIM-signed where the address is at a domain the server signs for. Vendor/CNA’s CVSS 3.1 assessment (base score 6.5/10) rates confidentiality and availability impact as none; integrity impact as high.