High severity7.5NVD Advisory· Published Apr 2, 2026· Updated Apr 9, 2026

CVE-2026-34834

Description

Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to version 1.4.10, the verifyIdentity() function contained logic that returned true if no session cookies were present. This allowed unauthenticated attackers to bypass security checks and access/modify user settings via the /api/settings endpoint by providing arbitrary headers. This issue has been patched in version 1.4.10.

Affected products

Bulwarkmail/Webmail
cpe:2.3:a:bulwarkmail:webmail:*:*:*:*:*:*:*:*
Range: <1.4.10

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

github.com/bulwarkmail/webmail/security/advisories/GHSA-4356-876g-rfmhnvdVendor Advisory
github.com/bulwarkmail/webmail/releases/tag/1.4.10nvdProduct

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000