Webmail EUVD-2026-18530

Bulwark Webmail versions prior to 1.4.10 self-hosted with Stalwart Mail Server. Remote unauthenticated attacker can access GET /api/auth/session endpoint to retrieve plaintext user passwords from JSON responses. No victim interaction required.

The CVSS 4.0 score of 8.7 reflects high confidentiality impact (VC:H) with network attack vector (AV:N), low complexity (AC:L), and no privileges required (PR:N). However, real-world risk assessment requires nuanced interpretation. The vulnerability enables passive credential harvesting rather than active system compromise, meaning exploitation depends on adversary positioning (network access, browser access, or proxy control). No public exploit identified at time of analysis, and EPSS data not provided in intelligence inputs. The attack requires no user interaction (UI:N) and low technical skill, making it automatable for positioned attackers monitoring HTTP traffic or accessing browser data stores. Primary risk scenarios include: corporate proxy administrators harvesting employee credentials, malicious browser extensions capturing API responses, compromised CDNs or network paths intercepting traffic, and forensic analysis of browser caches on shared systems. The vulnerability's severity is amplified because credential exposure enables persistent access beyond the immediate session-harvested passwords can be reused for email account access, potentially across multiple services if users reuse passwords. While not actively exploited according to available data, the technical simplicity (unauthenticated network access, no attack complexity) combined with high-value target (email credentials) creates meaningful risk for organizations using affected versions. Patch availability in version 1.4.10 significantly reduces risk for organizations with active update processes.

An attacker with network visibility (corporate proxy administrator, malicious ISP, or man-in-the-middle position) monitors HTTP/HTTPS traffic to a Bulwark Webmail instance. When legitimate users authenticate and their browsers request the /api/auth/session endpoint, the attacker captures the JSON response containing plaintext passwords. Using harvested credentials, the attacker gains persistent access to user email accounts, bypassing session timeouts and enabling reconnaissance of organizational communications. Alternatively, malware or malicious browser extensions on user systems passively log API responses to exfiltrate credentials without network-level access. The attack requires no authentication or user interaction, only positioning to observe API traffic or browser storage.