CVE-2026-35389 describes an improper certificate validation vulnerability (CWE-295) in Bulwark Webmail prior to version 1.4.11. The S/MIME signature verification process did not validate the certificate trust chain due to the checkChain parameter being set to false. Consequently, emails signed with self-signed or untrusted certificates were displayed as validly signed, potentially misleading users about the authenticity of email content. This vulnerability was fixed in Bulwark Webmail version 1.4.11.

The vulnerability allows an attacker to present emails signed with self-signed or untrusted certificates as if they were validly signed. This can lead to users trusting malicious emails under false pretenses, potentially facilitating phishing or other social engineering attacks. No known exploits are reported in the wild at this time.

Upgrade Bulwark Webmail to version 1.4.11 or later, where the certificate trust chain validation in S/MIME signature verification is properly enforced. Patch status is not explicitly stated but the fix is included in version 1.4.11. Users should verify they are running this version or newer to mitigate this vulnerability.