Webmail CVE-2026-35390

The CVSS 5.3 score reflects moderate real-world risk constrained by several mitigating factors. The attack vector is network-based and requires no authentication (PR:N), but critically depends on user interaction (UI:P), as the attacker must craft a malicious email that the user opens in Webmail. The impact scope is limited to confidentiality and integrity of the user session (SC:L, SI:L) rather than system-wide compromise. The CVSS vector indicates no vertical privilege escalation (all M* modifiers are X/unknown). No active exploitation signal is present-no KEV status or public POC has been reported-suggesting this remains a theoretical but real vulnerability. For organization-level risk, the primary concern is session hijacking or credential theft affecting individual users; the attack is not automatable across multiple targets without per-user email injection. Organizations running Webmail should prioritize patching to 1.4.11, but this is not an emergency-tier incident requiring immediate out-of-band response.

An attacker crafts a malicious email containing embedded JavaScript (e.g., in HTML body or within an image src attribute with JavaScript protocol). When a Bulwark Webmail user opens the email in their browser, the CSP enforcement failure allows the script to execute without restriction. The script extracts the user's session token from localStorage or a cookie and sends it to an attacker-controlled server, enabling account takeover. Alternatively, the script could perform actions (reading other emails, modifying settings, forwarding emails) on behalf of the authenticated user. No public POC exists for this vulnerability at the time of analysis.