EUVD-2026-18531Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
6DescriptionGitHub Advisory
Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to version 1.4.10, the verifyIdentity() function contained logic that returned true if no session cookies were present. This allowed unauthenticated attackers to bypass security checks and access/modify user settings via the /api/settings endpoint by providing arbitrary headers. This issue has been patched in version 1.4.10.
AnalysisAI
Unauthenticated authentication bypass in Bulwark Webmail versions prior to 1.4.10 allows remote attackers to access and modify user settings without credentials. The vulnerability stems from flawed verifyIdentity() logic that returns true when session cookies are absent, enabling unauthorized manipulation of the /api/settings endpoint through arbitrary header injection. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Bulwark Webmail versions prior to 1.4.10 integrated with Stalwart Mail Server. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.7 reflects High severity with critical characteristics: network-accessible (AV:N), low attack complexity (AC:L), no attack requirements (AT:N), no privileges required (PR:N), and no user interaction needed (UI:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated remote attacker identifies a Bulwark Webmail instance (e.g., through Shodan or targeted reconnaissance of organizations using Stalwart Mail Server). The attacker crafts HTTP POST requests to the /api/settings endpoint without including valid session cookies, but includes arbitrary headers to bypass the flawed verifyIdentity() check. … |
| Remediation | Vendor-released patch: Bulwark Webmail version 1.4.10 fully remediates this authentication bypass vulnerability by correcting the flawed verifyIdentity() logic. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all Bulwark Webmail instances and identify versions prior to 1.4.10; document current patch levels and deployment count. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today