CVE-2026-114470
- Source
- https://cve.org/CVERecord?id=CVE-2026-114470
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-114470.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-114470
- Published
- 2026-10-21T15:11:20Z
- Modified
- 2026-10-22T02:48:51Z
- Severity
-
- 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N CVSS Calculator
- Summary
- Cross-Site Request Forgery (CSRF) in hMailServer
- Details
-
Cross-site request forgery in the REST API of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote attacker to make an authenticated user's browser perform a state-changing request. The REST API accepts HTTP Basic authentication and answers a browser with a Basic sign-in box; a browser caches the credential once the box is answered and sends it with later requests to that origin, including a top-level form post from another site, and the server reads a request body whatever its declared content type. The cross-site protection covered only the cookie session (a header a cross-site form cannot set, and a SameSite=Strict cookie); HTTP Basic was not held to it. A page under an attacker's control, visited by a user whose browser holds a cached Basic credential for the REST API - typically an administrator who signed in through the box - could therefore cause a state-changing request such as creating a domain, an account or an API key, or changing a setting, with the victim's credential. The attacker cannot read the cross-origin response, so the forgery is blind.
- Database specific
{ "cna_assigner": "GitLab", "cwe_ids": [ "CWE-352" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114470.json" }- References