Which versions of Webmail are affected by CVE-2026-34833?

Bulwark Webmail versions prior to 1.4.10 transmit user passwords in plaintext through its session API, exposing credentials to network eavesdropping and local storage compromise.. A patch is available.

How to fix or mitigate CVE-2026-34833?

Within 24 hours: Identify all Bulwark Webmail instances and document current versions in use. Within 7 days: Upgrade all instances to version 1.4.10 or later; validate deployment across production and secondary environments. Within 30 days: Conduct credential audit for potentially exposed accounts; reset passwords for users who accessed webmail during vulnerable version operation; review network monitoring logs for suspicious credential access patterns.

Webmail CVE-2026-34833

Q: What is the CVSS score of CVE-2026-34833?

CVE-2026-34833 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-18530 HIGH

Cleartext Storage of Sensitive Information (CWE-312)

2026-04-02 GitHub_M

Information Disclosure Webmail

8.7

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:08 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

1.4.10

EUVD ID Assigned

Apr 02, 2026 - 19:31 euvd

EUVD-2026-18530

Analysis Generated

Apr 02, 2026 - 19:31 vuln.today

CVE Published

Apr 02, 2026 - 19:11 nvd

HIGH 8.7

DescriptionCVE.org

Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to version 1.4.10, the GET /api/auth/session endpoint previously included the user's plaintext password in the JSON response. This exposed credentials to browser logs, local caches, and network proxie. This issue has been patched in version 1.4.10.

AnalysisAI

Bulwark Webmail prior to version 1.4.10 exposes user plaintext passwords through its session API endpoint, allowing network-positioned attackers to harvest credentials from browser logs, local caches, and network proxies. The /api/auth/session endpoint returns authentication credentials in JSON responses without encryption, creating an information disclosure vulnerability (CWE-312: Cleartext Storage of Sensitive Information). No public exploit identified at time of analysis, though exploitation requires only network access with no authentication (CVSS vector AV:N/AC:L/PR:N), making this a straightforward attack for adversaries monitoring network traffic or accessing browser storage.

Technical ContextAI

This vulnerability affects the Bulwark Webmail client (CPE 2.3:a:bulwarkmail:webmail), a self-hosted web interface for Stalwart Mail Server. The root cause is CWE-312 (Cleartext Storage of Sensitive Information), where the application's session management endpoint returns sensitive authentication data without proper protection. The GET /api/auth/session API endpoint includes plaintext passwords in its JSON response payload, violating fundamental security principles for credential handling. When applications expose authentication secrets through API responses, those credentials become accessible to multiple attack surfaces: browser developer consoles logging HTTP responses, local browser caches storing API data, HTTP proxies (corporate, ISP, or malicious) intercepting traffic, and browser extensions with network monitoring capabilities. Modern web applications should never transmit passwords in API responses after initial authentication; session tokens or encrypted credentials are the standard secure alternatives. This architectural flaw represents a fundamental mishandling of sensitive data in the session management layer.

RemediationAI

Upgrade immediately to Bulwark Webmail version 1.4.10 or later, which patches the credential exposure vulnerability in the session API endpoint. The vendor released version 1.4.10 specifically addressing this issue, available at https://github.com/bulwarkmail/webmail/releases/tag/1.4.10. Organizations should prioritize this update for internet-facing deployments and environments with untrusted network paths. Post-upgrade, administrators should review server logs, proxy logs, and browser cache storage for potential credential exposure during the vulnerability window, and consider forcing password resets for affected users if credential interception is suspected. No workarounds are documented in the security advisory; upgrading to the patched version is the only complete remediation. Consult the full security advisory at https://github.com/bulwarkmail/webmail/security/advisories/GHSA-47pm-883h-885r for additional vendor guidance.