Bulwark Webmail, a self-hosted webmail client for Stalwart Mail Server, contained an authentication bypass vulnerability (CWE-287) in versions before 1.4.10. The verifyIdentity() function erroneously granted access if session cookies were missing, permitting unauthenticated attackers to bypass security checks. This allowed unauthorized access and modification of user settings through the /api/settings endpoint by crafting arbitrary headers. The vulnerability has been patched in version 1.4.10.

An unauthenticated attacker could bypass authentication controls and gain unauthorized access to user settings, potentially leading to unauthorized modification of user configurations. This could compromise user account integrity and privacy. There are no known exploits in the wild at this time.

Upgrade Bulwark Webmail to version 1.4.10 or later, where this authentication bypass vulnerability has been patched. No additional mitigations are indicated by the vendor advisory.