Bulwarkmail vulnerabilities
We track 5 vulnerabilities in Bulwarkmail products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on October 20, 2026.
Latest Bulwarkmail vulnerabilities
- 7.5 High severity
webmail: Server-Side Request Forgery
Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.9.2, the unauthenticated POST /api/fetch-ical endpoint validates a caller-supplied hostname with one DNS lookup and then passes the URL to fetch, which performs a separate loo
- 7.5 High severity
webmail: Use of Less Trusted Source
Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.4.11, the getClientIP() function in lib/admin/session.ts trusted the first (leftmost) entry of the X-Forwarded-For header, which is fully controlled by the client. An attacker
- 7.5 High severity
webmail: Improper Certificate Validation
Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.4.11, S/MIME signature verification did not validate the certificate trust chain (checkChain: false). Any email signed with a self-signed or untrusted certificate was displaye
- 7.5 High severity
webmail: Improper Authentication
Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to version 1.4.10, the verifyIdentity() function contained logic that returned true if no session cookies were present. This allowed unauthenticated attackers to bypass security ch
- 7.5 High severity
webmail: Cleartext Storage of Sensitive Information
Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to version 1.4.10, the GET /api/auth/session endpoint previously included the user's plaintext password in the JSON response. This exposed credentials to browser logs, local caches