CVE-2026-34834: falha de alta gravidade em bulwarkmail webmail
Bulwark Webmail: Authentication Bypass in verifyIdentity() due to missing cookie validation
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.7epss 0.3%
Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to version 1.4.10, the verifyIdentity() function contained logic that returned true if no session cookies were present. This allowed unauthenticated attackers to bypass security checks and access/modify user settings via the /api/settings endpoint by providing arbitrary headers. This issue has been patched in version 1.4.10.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Produtos afetados
bulwarkmail · webmailCVEs relacionadas — bulwarkmail webmail
No mesmo produto, das mais perigosas para as menos.
CVE-2026-113728HIGHBulwark Webmail: DNS-rebinding SSRF in public iCalendar fetch endpointEPSS 0.5%CVE-2026-35389HIGHBulwark Webmail S/MIME signature verification accepted self-signed certificatesEPSS 0.2%CVE-2026-35390MEDIUMContent-Security-Policy was set to Report-Only mode, failing to block XSS attacksEPSS 0.2%CVE-2026-34833HIGHBulwark Webmail: Information Exposure: password returned in /api/auth/sessionEPSS 0.2%CVE-2026-35391HIGHBulwark Webmail getClientIP() trusted client-controlled X-Forwarded-For value, enabling rate limit bypass and audit log forgeryEPSS 0.1%