CVE-2026-34834 | THREATINT

Description

Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to version 1.4.10, the verifyIdentity() function contained logic that returned true if no session cookies were present. This allowed unauthenticated attackers to bypass security checks and access/modify user settings via the /api/settings endpoint by providing arbitrary headers. This issue has been patched in version 1.4.10.

PUBLISHED Reserved 2026-03-30 | Published 2026-04-02 | Updated 2026-04-03 | Assigner GitHub_M

HIGH: 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Problem types

CWE-287: Improper Authentication

Product status

< 1.4.10

affected

References

github.com/...ebmail/security/advisories/GHSA-4356-876g-rfmh

github.com/bulwarkmail/webmail/releases/tag/1.4.10

cve.org (CVE-2026-34834)

nvd.nist.gov (CVE-2026-34834)

Download JSON