TI-2026-27078 CVE-2026-34834
Bulwark Webmail: Authentication Bypass in verifyIdentity() due to missing cookie validation
Priority MEDIUM 43
Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server.
bulwarkmail
Records6All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high5CVSS 7.0–8.9
Exploited now
bulwarkmail records in CISA KEVNo bulwarkmail vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
6 records
TI-2026-27077 CVE-2026-34833
Bulwark Webmail: Information Exposure: password returned in /api/auth/session
Priority MEDIUM 43
Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server.
Priority LOW 39
Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server.
TI-2026-27527 CVE-2026-35391
Bulwark Webmail getClientIP() trusted client-controlled X-Forwarded-For value, enabling…
Priority LOW 37
Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server.
TI-2026-27525 CVE-2026-35389
Bulwark Webmail S/MIME signature verification accepted self-signed certificates
Priority LOW 37
Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server.
TI-2026-27526 CVE-2026-35390
Content-Security-Policy was set to Report-Only mode, failing to block XSS attacks
Priority LOW 23
Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server.