Which versions of Webmail are affected by CVE-2026-35389?

Bulwark Webmail versions prior to 1.4.11 contain a critical S/MIME signature verification flaw that allows attackers to forge digitally signed emails appearing legitimate to recipients, compromising…. A patch is available.

How to fix or mitigate CVE-2026-35389?

Within 24 hours: Identify all Bulwark Webmail deployments and document current versions. Within 7 days: Deploy vendor-released patch to version 1.4.11 or later across all affected instances; validate S/MIME signature verification functionality post-patch. Within 30 days: Conduct audit of digitally signed emails received during vulnerable period for authenticity; implement user awareness training on S/MIME verification best practices and manual certificate validation.

Webmail CVE-2026-35389

Q: What is the CVSS score of CVE-2026-35389?

CVE-2026-35389 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-19478 HIGH

Improper Certificate Validation (CWE-295)

2026-04-06 GitHub_M

Information Disclosure Webmail

8.7

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:05 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

1.4.11

EUVD ID Assigned

Apr 06, 2026 - 21:00 euvd

EUVD-2026-19478

Analysis Generated

Apr 06, 2026 - 21:00 vuln.today

CVE Published

Apr 06, 2026 - 20:11 nvd

HIGH 8.7

DescriptionCVE.org

Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.4.11, S/MIME signature verification did not validate the certificate trust chain (checkChain: false). Any email signed with a self-signed or untrusted certificate was displayed as having a valid signature. This vulnerability is fixed in 1.4.11.

AnalysisAI

S/MIME signature verification in Bulwark Webmail prior to 1.4.11 fails to validate certificate trust chains, allowing attackers to forge digitally signed emails using self-signed or untrusted certificates that appear legitimate to recipients. This integrity bypass affects all unauthenticated remote attackers (CVSS:4.0 AV:N/AC:L/PR:N) with high integrity impact. No public exploit identified at time of analysis, though the attack is straightforward given the disabled trust validation (checkChain: false configuration flaw). ENISA EUVD-2026-19478 classifies this as an information disclosure issue, though the primary risk is message authenticity compromise in encrypted email workflows.

Technical ContextAI

S/MIME (Secure/Multipurpose Internet Mail Extensions) provides cryptographic signing and encryption for email messages using X.509 certificates. Valid signature verification requires both cryptographic validation (signature matches public key) and certificate trust chain validation (certificate chains to a trusted root CA). This vulnerability stems from CWE-295 (Improper Certificate Validation), where Bulwark Webmail's signature verification explicitly disabled trust chain checking (checkChain: false parameter). The affected component is Bulwark Webmail (CPE cpe:2.3:a:bulwarkmail:webmail), a self-hosted webmail client designed for Stalwart Mail Server. Without trust chain validation, the application only verifies that the signature mathematically matches the certificate's public key, but not whether that certificate was issued by a legitimate Certificate Authority. This allows any attacker to generate a self-signed certificate, sign malicious emails, and have those signatures displayed as valid to Bulwark Webmail users, completely undermining S/MIME's authenticity guarantees.

RemediationAI

Upgrade Bulwark Webmail to version 1.4.11 or later, which restores proper certificate trust chain validation in S/MIME signature verification. The vendor-released patch addresses the root cause by enabling checkChain validation to ensure certificates are verified against trusted certificate authorities before displaying signatures as valid. Organizations should prioritize this upgrade for any production deployments where users rely on S/MIME signatures for email authenticity. The complete security advisory with upgrade instructions is available at https://github.com/bulwarkmail/webmail/security/advisories/GHSA-v6w6-338p-p256. No workarounds exist that provide equivalent security; disabling S/MIME signature display entirely would eliminate the false-positive trust indicator but also remove legitimate signature verification functionality. After upgrading, administrators should audit previously received S/MIME-signed emails, as messages signed with untrusted certificates prior to patching may have been incorrectly displayed as valid.