{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-104659", "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "state": "PUBLISHED", "assignerShortName": "GitLab", "dateReserved": "2026-10-02T07:38:59.115Z", "datePublished": "2026-10-08T10:52:55.630Z", "dateUpdated": "2026-10-08T14:24:55.631Z"}, "containers": {"cna": {"title": "Origin Validation Error in hMailServer", "descriptions": [{"lang": "en", "value": "Missing Host header validation and missing throttling of failed administrator sign-ins in the REST API listener of Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a remote attacker to brute-force the server administrator's password through the administrator's own browser by DNS rebinding. The listener, which is off by default and bound to the loopback when enabled, answered requests whatever their Host header named, and a failed sign-in with the administrator's password from the loopback was neither auto-banned nor delayed. A web page whose host name the attacker rebinds to 127.0.0.1, opened in a browser on the server, can therefore send authenticated requests to the listener, read the answers and try administrator passwords at full speed until one is accepted, giving the attacker full administrative control of the mail server."}], "affected": [{"vendor": "Progressive Robot Ltd", "product": "hMailServer", "repo": "https://gitlab.com/hmailserver/hmailserver", "versions": [{"version": "6.0.0", "status": "affected", "lessThan": "6.3.6", "versionType": "semver"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-346: Origin Validation Error", "cweId": "CWE-346", "type": "CWE"}]}], "references": [{"url": "https://gitlab.com/hmailserver/hmailserver/-/work_items/57"}, {"url": "https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.6"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "solutions": [{"lang": "en", "value": "Upgrade to hMailServer 6.3.6, whose REST listener refuses an unexpected Host before any authentication and delays a wrong administrator password on every route. Until then: keep the REST API off (RestApiPort 0, the default) or reach it only through a reverse proxy that checks the Host header; give the administrator a long random password and enrol its second factor; do not browse the web from the server."}], "credits": [{"lang": "en", "value": "Found in the hMailServer project's own security review (Progressive Robot Ltd)", "type": "finder"}], "providerMetadata": {"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab", "dateUpdated": "2026-10-08T10:52:55.630Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-08T14:24:38.860426Z", "id": "CVE-2026-104659", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-08T14:24:55.631Z"}}]}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "hMailServer", "repo": "https://gitlab.com/hmailserver/hmailserver", "vendor": "Progressive Robot Ltd", "versions": [{"lessThan": "6.3.6", "status": "affected", "version": "6.0.0", "versionType": "semver"}]}], "source": "cve@gitlab.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Host header validation and missing throttling of failed administrator sign-ins in the REST API listener of Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a remote attacker to brute-force the server administrator's password through the administrator's own browser by DNS rebinding. The listener, which is off by default and bound to the loopback when enabled, answered requests whatever their Host header named, and a failed sign-in with the administrator's password from the loopback was neither auto-banned nor delayed. A web page whose host name the attacker rebinds to 127.0.0.1, opened in a browser on the server, can therefore send authenticated requests to the listener, read the answers and try administrator passwords at full speed until one is accepted, giving the attacker full administrative control of the mail server."}], "id": "CVE-2026-104659", "lastModified": "2026-10-08T11:16:44.013", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "cve@gitlab.com", "type": "Secondary"}]}, "published": "2026-10-08T11:16:44.013", "references": [{"source": "cve@gitlab.com", "url": "https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.6"}, {"source": "cve@gitlab.com", "url": "https://gitlab.com/hmailserver/hmailserver/-/work_items/57"}], "sourceIdentifier": "cve@gitlab.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-346"}], "source": "cve@gitlab.com", "type": "Primary"}]}

{}

{"created": "2026-10-08T12:45:18.251814+00:00", "updated": "2026-10-08T12:45:18.251821+00:00", "vendors": []}