CVE-2026-35389: fallo de gravedad alta en bulwarkmail webmail
Bulwark Webmail S/MIME signature verification accepted self-signed certificates
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.7epss 0.2%
Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.4.11, S/MIME signature verification did not validate the certificate trust chain (checkChain: false). Any email signed with a self-signed or untrusted certificate was displayed as having a valid signature. This vulnerability is fixed in 1.4.11.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Productos afectados
bulwarkmail · webmailCVEs relacionadas — bulwarkmail webmail
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-113728HIGHBulwark Webmail: DNS-rebinding SSRF in public iCalendar fetch endpointEPSS 0.5%CVE-2026-34834HIGHBulwark Webmail: Authentication Bypass in verifyIdentity() due to missing cookie validationEPSS 0.3%CVE-2026-35390MEDIUMContent-Security-Policy was set to Report-Only mode, failing to block XSS attacksEPSS 0.2%CVE-2026-34833HIGHBulwark Webmail: Information Exposure: password returned in /api/auth/sessionEPSS 0.2%CVE-2026-35391HIGHBulwark Webmail getClientIP() trusted client-controlled X-Forwarded-For value, enabling rate limit bypass and audit log forgeryEPSS 0.1%