CVE-2026-35390 is a cross-site scripting (CWE-79) vulnerability in Bulwark Webmail's reverse proxy component (proxy.ts) before version 1.4.11. The issue arises because the proxy sets the Content-Security-Policy-Report-Only header rather than the enforcing Content-Security-Policy header, which means that malicious scripts injected via crafted email HTML are logged but not blocked. Exploiting this vulnerability allows an attacker to execute arbitrary JavaScript in the context of the webmail application, potentially leading to session token theft or unauthorized actions performed on behalf of the user. The vulnerability is addressed by updating to Bulwark Webmail version 1.4.11 where the correct enforcing header is set.

Successful exploitation allows arbitrary JavaScript execution within the webmail application context. This can lead to theft of session tokens or unauthorized actions performed by the attacker impersonating the user. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, and user interaction needed.

Upgrade Bulwark Webmail to version 1.4.11 or later, where the reverse proxy sets the enforcing Content-Security-Policy header instead of the Report-Only header, effectively blocking XSS attacks. No other mitigation is specified or required once the update is applied.