Bulwark Webmail before version 1.4.11 contains a vulnerability (CWE-348) in the getClientIP() function located in lib/admin/session.ts. This function incorrectly trusts the first (leftmost) IP address in the X-Forwarded-For HTTP header, which is fully controllable by the client. Because of this, an attacker can spoof their IP address to bypass IP-based rate limiting mechanisms designed to protect the admin login from brute-force attacks. Furthermore, the attacker can manipulate audit logs to make malicious actions appear as if they originated from arbitrary IP addresses. The vulnerability has a CVSS 4.0 score of 8.7, indicating high severity. The vulnerability is resolved in Bulwark Webmail version 1.4.11.

An attacker can bypass IP-based rate limiting protections on the admin login by forging the X-Forwarded-For header, enabling brute-force password attacks. Additionally, audit logs can be falsified to misattribute malicious activity to arbitrary IP addresses, potentially hindering incident response and forensic investigations. There are no known exploits in the wild at this time.

Upgrade Bulwark Webmail to version 1.4.11 or later, where this vulnerability is fixed. Since this is a self-hosted product, administrators must apply the update themselves. Patch status is confirmed fixed in version 1.4.11. No other mitigations are indicated by the vendor advisory.