Webmail EUVD-2026-18531

Bulwark Webmail versions prior to 1.4.10 integrated with Stalwart Mail Server. Remote unauthenticated attacker can access /api/settings endpoint without session cookies. No victim interaction required. Default configurations affected.

The CVSS 4.0 score of 8.7 reflects High severity with critical characteristics: network-accessible (AV:N), low attack complexity (AC:L), no attack requirements (AT:N), no privileges required (PR:N), and no user interaction needed (UI:N). The vulnerability enables high confidentiality breach through settings access and high integrity impact (VI:H) through unauthorized settings modification, though availability impact is none. Real-world risk assessment presents a nuanced picture: while no public exploit identified at time of analysis and the software targets self-hosted deployments (limiting exposure compared to SaaS), the simplicity of exploitation (merely sending requests without cookies) makes this trivially automatable. The attack requires only HTTP client access and knowledge of the /api/settings endpoint. Self-hosted webmail installations are high-value targets as they control email communications and user credentials. The narrow deployment base (specialized webmail client for Stalwart Mail Server) reduces overall internet-wide risk, but organizations running affected versions face immediate exposure. SSVC framework assessment: exploitation status is public with no confirmed active exploitation, automatable (yes - trivial HTTP requests), technical impact is total (authentication bypass grants unauthorized access to user configuration), making this a priority remediation candidate for affected deployments despite limited widespread targeting.

An unauthenticated remote attacker identifies a Bulwark Webmail instance (e.g., through Shodan or targeted reconnaissance of organizations using Stalwart Mail Server). The attacker crafts HTTP POST requests to the /api/settings endpoint without including valid session cookies, but includes arbitrary headers to bypass the flawed verifyIdentity() check. Because the authentication function incorrectly returns true when cookies are absent, the attacker successfully reads current user settings (including potentially sensitive email configuration, filters, and account details) and modifies settings to redirect emails, disable security features, or alter user preferences. This could enable secondary attacks such as email interception, spam relay configuration, or account lockout. The low attack complexity and network accessibility make this exploitable by unsophisticated attackers with basic HTTP client tools.