PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-35390 Bulwarkmail CVE debrief

CVE-2026-35390 is a security vulnerability in Bulwark Webmail, a self-hosted webmail client for Stalwart Mail Server. Prior to version 1.4.11, the application incorrectly set the Content-Security-Policy-Report-Only header instead of the enforcing Content-Security-Policy header. This error allowed cross-site scripting (XSS) attacks to occur, as malicious scripts were logged but not blocked. An attacker who could inject script content, for example, via crafted email HTML, could execute arbitrary JavaScript within the application's context. This could potentially lead to the theft of session tokens or allow the attacker to perform actions on behalf of the user. The vulnerability has been fixed in version 1.4.11.

Vendor
Bulwarkmail
Product
Webmail
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-06
Original CVE updated
2026-07-24
Advisory published
2026-04-06
Advisory updated
2026-07-24

Who should care

Users of Bulwark Webmail, especially those hosting their own Stalwart Mail Server, should be aware of this vulnerability. If an attacker can inject malicious scripts into emails, they could exploit this vulnerability to execute arbitrary JavaScript, potentially gaining unauthorized access to user sessions or performing actions as the user. Therefore, administrators and users of affected versions (prior to 1.4.11) should prioritize upgrading to the latest version to mitigate this risk.

Technical summary

The Bulwark Webmail application, prior to version 1.4.11, incorrectly configured its security headers by setting Content-Security-Policy-Report-Only instead of Content-Security-Policy. This configuration allowed XSS attacks to occur because it only logged violations rather than enforcing the policy. An attacker could inject malicious JavaScript via crafted email content, which would then be executed within the context of the application. This could lead to unauthorized actions or data theft. The vulnerability is characterized by a CVSS score of 5.3 and a severity rating of MEDIUM.

Defensive priority

Medium priority should be given to updating Bulwark Webmail to version 1.4.11 or later, as the vulnerability allows for XSS attacks by not properly enforcing content security policies.

Recommended defensive actions

  • Upgrade Bulwark Webmail to version 1.4.11 or later
  • Review and monitor email content for potential script injection attempts
  • Implement additional security measures such as input validation and Content Security Policy enforcement
  • Educate users about the risks of clicking on suspicious links or opening malicious emails
  • Perform a thorough review of system logs for signs of potential exploitation
  • Verify that all user sessions are properly secured and monitored
  • Conduct a vulnerability scan to identify any other potential weaknesses

Evidence notes

The CVE record was published on 2026-04-06T21:16:20.723Z and was last modified on 2026-07-24T21:10:00.143Z. The NVD entry is currently Analyzed. The vulnerability details were obtained from the NVD and the vendor advisory on GitHub.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-35390 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-35390

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-35390 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-35390

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.