hMailServer authorization issue vulnerability

Versions 6.0.0 through 6.3.6 of hMailServer contain an authorization issue vulnerability. This vulnerability stems from a lack of authorization checks in the REST and COM management APIs. Remote authenticated users with credentials restricted to specific domains can modify email routing and domai...

hMailServer authorization issue vulnerability

hMailServer has an authorization issue vulnerability stemming from improper authorization in its REST management API. The DELETE /api/v1/role-assignments/address endpoint only checks whether the currently held credentials grant sufficient permissions; it fails to verify whether those permissions...