Which versions of Webmail are affected by EUVD-2026-19480?

Bulwark Webmail versions before 1.4.11 contain an unauthenticated IP spoofing vulnerability that allows attackers to bypass rate limiting on admin login pages and forge audit logs, directly enabling…. A patch is available.

How to fix or mitigate EUVD-2026-19480?

Within 24 hours: Identify all Bulwark Webmail deployments and document current versions. Within 7 days: Upgrade all instances to version 1.4.11 or later per vendor guidance; validate upgrade completion across all systems. Within 30 days: Audit admin login attempts and audit logs for the past 90 days to identify potential unauthorized access or log forgery; review access controls on admin interfaces and consider network-based rate limiting as defense-in-depth.

Webmail EUVD-2026-19480

Q: What is the CVSS score of EUVD-2026-19480?

EUVD-2026-19480 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-35391 HIGH

Use of Less Trusted Source (CWE-348)

2026-04-06 GitHub_M

Authentication Bypass Webmail

8.7

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:05 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

1.4.11

EUVD ID Assigned

Apr 06, 2026 - 21:00 euvd

EUVD-2026-19480

Analysis Generated

Apr 06, 2026 - 21:00 vuln.today

CVE Published

Apr 06, 2026 - 20:17 nvd

HIGH 8.7

DescriptionCVE.org

Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.4.11, the getClientIP() function in lib/admin/session.ts trusted the first (leftmost) entry of the X-Forwarded-For header, which is fully controlled by the client. An attacker could forge their source IP address to bypass IP-based rate limiting (enabling brute-force attacks against the admin login) or forge audit log entries (making malicious activity appear to originate from arbitrary IP addresses). This vulnerability is fixed in 1.4.11.

AnalysisAI

IP address spoofing in Bulwark Webmail versions prior to 1.4.11 allows unauthenticated remote attackers to bypass IP-based rate limiting and forge audit log entries by manipulating the X-Forwarded-For HTTP header. The vulnerability enables brute-force attacks against admin login interfaces and allows malicious actors to mask their true origin in security logs. CVSS 8.7 reflects high integrity impact (VI:H) with network-accessible attack vector requiring no privileges (AV:N, PR:N). No public exploit identified at time of analysis, though exploitation is straightforward given the trust-boundary violation in HTTP header processing.

Technical ContextAI

This vulnerability stems from improper trust of the X-Forwarded-For HTTP header in the getClientIP() function within lib/admin/session.ts. The implementation incorrectly trusts the leftmost (first) IP address in the X-Forwarded-For header chain, which is attacker-controlled client input. In proper proxy configurations, X-Forwarded-For is a comma-separated list where the leftmost IP is added by the client and rightmost entries are appended by successive proxies. Security-critical code should extract the client IP from the rightmost trusted proxy entry, not the leftmost client-supplied value. This is classified as CWE-348 (Use of Less Trusted Source), specifically a trust boundary violation where external input is treated as authoritative for security decisions. The affected product is Bulwark Webmail (CPE: cpe:2.3:a:bulwarkmail:webmail), a self-hosted webmail client specifically designed for Stalwart Mail Server. The vulnerability affects authentication rate limiting and audit logging mechanisms, both critical security controls for administrative interfaces.

RemediationAI

Upgrade Bulwark Webmail to version 1.4.11 or later, which contains a fix for the X-Forwarded-For header processing vulnerability. The vendor-released patch corrects the getClientIP() function in lib/admin/session.ts to properly validate and extract client IP addresses from proxy headers. Organizations should prioritize this upgrade for any internet-facing installations or environments where admin interfaces are accessible to untrusted networks. Until patching is complete, consider implementing additional administrative controls such as network-level IP allowlisting via firewall rules, VPN-only access to admin interfaces, or deployment behind a properly configured reverse proxy that strips client-supplied X-Forwarded-For headers and replaces them with trusted values. Review audit logs for suspicious entries with IP addresses that do not match known administrative access patterns, as historical log data may contain forged entries from prior exploitation attempts. The official security advisory with detailed remediation guidance is available at https://github.com/bulwarkmail/webmail/security/advisories/GHSA-7pj2-232x-6698.