CVE-2026-113728: CWE-918: Server-Side Request Forgery (SSRF) in bulwarkmail webmail

Bulwark Webmail versions before 1.9.2 contain an SSRF vulnerability (CWE-918) due to a check-then-fetch pattern in the /api/fetch-ical endpoint and certain authenticated flows. The endpoint validates a hostname with one DNS lookup but then performs a separate DNS lookup when fetching the URL. An attacker who controls the authoritative DNS can respond with a public IP during validation and then rebind the hostname to a loopback, private, link-local, or cloud metadata IP for the actual connection. This allows the attacker to retrieve up to 10 MB of internal HTTP or HTTPS responses from the server. The vulnerability affects unauthenticated and authenticated endpoints and is resolved in version 1.9.2.

An attacker can exploit this SSRF vulnerability to cause the Bulwark Webmail server to make HTTP or HTTPS requests to internal or cloud metadata addresses, potentially exposing sensitive internal data up to 10 MB in size. The vulnerability does not require authentication for the /api/fetch-ical endpoint, increasing the risk of exploitation. The CVSS score of 7.5 (high) reflects the potential confidentiality impact without integrity or availability impact.

This vulnerability is fixed in Bulwark Webmail version 1.9.2. Users should upgrade to version 1.9.2 or later to remediate this issue. No other mitigation steps are indicated or required according to the available data.