Webmail CVE-2026-35389

Bulwark Webmail versions prior to 1.4.11 with S/MIME signature verification enabled. Attacker sends email signed with self-signed or untrusted certificate. No authentication required; victim must view the email in Bulwark Webmail to be deceived by false signature validity indicator.

The CVSS 4.0 score of 8.7 with vector AV:N/AC:L/PR:N/UI:N reflects the ease of exploitation (network-accessible, low complexity, no authentication or user interaction required) and high integrity impact (VI:H). However, real-world risk requires contextual assessment. The attack is trivially executable by any remote party capable of sending email, requiring only the ability to generate self-signed certificates and craft S/MIME-signed messages. No authentication barriers exist, and exploitation can be fully automated. The technical impact is limited to integrity compromise of email signatures rather than confidentiality breach or system availability, which moderates severity compared to RCE vulnerabilities. SSVC framework considerations indicate this is automatable with integrity impact on end-user trust in signed communications. The vulnerability affects organizations relying on S/MIME signatures for email authenticity verification, particularly in regulated industries where signed email provides non-repudiation. While no public exploit code exists, the attack technique is well-documented in cryptographic literature and requires minimal sophistication. Priority should be high for organizations using Bulwark Webmail in production where users depend on S/MIME signature validation for business-critical communications or compliance workflows.

An attacker generates a self-signed X.509 certificate claiming to represent a trusted entity such as a corporate executive or financial institution. The attacker crafts a phishing email requesting wire transfer authorization or credential disclosure, signs it with the self-signed certificate using standard S/MIME tools, and sends it to Bulwark Webmail users. Recipients see a valid signature indicator in the webmail interface, falsely believing the message originated from the claimed sender and was cryptographically authenticated. The user trusts the signed message and executes the fraudulent request, resulting in financial loss or credential compromise. This attack requires no special access beyond standard email delivery and leverages the broken trust chain validation to bypass the security guarantees S/MIME is designed to provide.