PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-35390 Bulwarkmail CVE debrief

CVE-2026-35390 is a security vulnerability in Bulwark Webmail, a self-hosted webmail client for Stalwart Mail Server. Prior to version 1.4.11, the application incorrectly set the Content-Security-Policy-Report-Only header instead of the enforcing Content-Security-Policy header. This error allowed cross-site scripting (XSS) attacks to occur, as malicious scripts were logged but not blocked. An attacker who could inject script content, for example, via crafted email HTML, could execute arbitrary JavaScript within the application's context. This could potentially lead to the theft of session tokens or allow the attacker to perform actions on behalf of the user. The vulnerability has been fixed in version 1.4.11.

Vendor
Bulwarkmail
Product
Webmail
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-06
Original CVE updated
2026-07-24
Advisory published
2026-04-06
Advisory updated
2026-07-24

Who should care

Users of Bulwark Webmail, especially those hosting their own Stalwart Mail Server, should be aware of this vulnerability. If an attacker can inject malicious scripts into emails, they could exploit this vulnerability to execute arbitrary JavaScript, potentially gaining unauthorized access to user sessions or performing actions as the user. Therefore, administrators and users of affected versions (prior to 1.4.11) should prioritize upgrading to the latest version to mitigate this risk.

Technical summary

The Bulwark Webmail application, prior to version 1.4.11, incorrectly configured its security headers by setting Content-Security-Policy-Report-Only instead of Content-Security-Policy. This configuration allowed XSS attacks to occur because it only logged violations rather than enforcing the policy. An attacker could inject malicious JavaScript via crafted email content, which would then be executed within the context of the application. This could lead to unauthorized actions or data theft. The vulnerability is characterized by a CVSS score of 5.3 and a severity rating of MEDIUM.

Defensive priority

Medium priority should be given to updating Bulwark Webmail to version 1.4.11 or later, as the vulnerability allows for XSS attacks by not properly enforcing content security policies.

Recommended defensive actions

  • Upgrade Bulwark Webmail to version 1.4.11 or later
  • Review and monitor email content for potential script injection attempts
  • Implement additional security measures such as input validation and Content Security Policy enforcement
  • Educate users about the risks of clicking on suspicious links or opening malicious emails
  • Perform a thorough review of system logs for signs of potential exploitation
  • Verify that all user sessions are properly secured and monitored
  • Conduct a vulnerability scan to identify any other potential weaknesses

Evidence notes

The CVE record was published on 2026-04-06T21:16:20.723Z and was last modified on 2026-07-24T21:10:00.143Z. The NVD entry is currently Analyzed. The vulnerability details were obtained from the NVD and the vendor advisory on GitHub.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-04-06T21:16:20.723Z and has not been modified since then. The NVD entry is currently Analyzed.