Threats affecting pkg:github/bulwarkmail/webmail

Bulwark Webmail versions prior to 1.9.2 contain a server-side request forgery (SSRF) vulnerability in the unauthenticated POST /api/fetch-ical endpoint and certain authenticated flows. The flaw arises from a DNS rebinding attack that allows an attacker controlling authoritative DNS to cause the server to fetch internal HTTP or HTTPS resources, potentially exposing up to 10 MB of internal data. This vulnerability is fixed in version 1.9.2.

CVE-2026-35391 is a high-severity vulnerability in Bulwark Webmail versions prior to 1.4.11. The vulnerability arises because the getClientIP() function trusts the first entry of the X-Forwarded-For header, which can be manipulated by an attacker. This allows attackers to forge their source IP address, potentially bypassing IP-based rate limiting and enabling brute-force attacks against the admin login. Additionally, attackers can forge audit log entries to mask malicious activity. The issue is fixed in version 1.4.11.

Bulwark Webmail versions prior to 1.4.11 have a cross-site scripting (XSS) vulnerability due to the reverse proxy setting a Content-Security-Policy-Report-Only header instead of an enforcing Content-Security-Policy header. This allowed script injection via crafted email HTML, enabling arbitrary JavaScript execution in the application's context. The vulnerability is fixed in version 1.4.11.

Bulwark Webmail versions prior to 1.4.11 contain a vulnerability in S/MIME signature verification where the certificate trust chain was not validated. This means emails signed with self-signed or untrusted certificates were incorrectly shown as having valid signatures. The issue is addressed in version 1.4.11. The vulnerability has a high severity with a CVSS score of 8.7.

Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to version 1.4.10, the verifyIdentity() function contained logic that returned true if no session cookies were present. This allowed unauthenticated attackers to bypass security checks and access/modify user settings via the /api/settings endpoint by providing arbitrary headers. This issue has been patched in version 1.4.10.

Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to version 1.4.10, the GET /api/auth/session endpoint previously included the user's plaintext password in the JSON response. This exposed credentials to browser logs, local caches, and network proxie. This issue has been patched in version 1.4.10.