CVE-2026-35391 Details
Description
Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.4.11, the getClientIP() function in lib/admin/session.ts trusted the first (leftmost) entry of the X-Forwarded-For header, which is fully controlled by the client. An attacker could forge their source IP address to bypass IP-based rate limiting (enabling brute-force attacks against the admin login) or forge audit log entries (making malicious activity appear to originate from arbitrary IP addresses). This vulnerability is fixed in 1.4.11.
A vulnerability in Bulwark Webmail prior to version 1.4.11 allows for manipulation of the X-Forwarded-For header, which is fully client-controlled. The getClientIP() function in lib/admin/session.ts trusted the first entry of this header, enabling attackers to forge their source IP addresses. This could bypass IP-based rate limiting, facilitating brute-force attacks on the admin login, and allow the forgery of audit log entries, making malicious activities appear to originate from chosen IP addresses. All users of versions prior to 1.4.11 who utilized the admin interface with rate limiting or audit logging are affected.
Users are advised to upgrade to Bulwark Webmail version 1.4.11 or later. For those whose deployments are not exposed to untrusted networks, the vulnerability may not be practically relevant, but upgrading is still recommended.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/bulwarkmail/webmail/security/advisories/GHSA-7pj2-232x-6698 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-348 | Use of Less Trusted Source | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| bulwarkmail webmail | < 1.4.11 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 9, 2026 | Initial Analysis | [email protected] |
| Apr 6, 2026 | New CVE Received | [email protected] |