Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Apr 2, 2026 · NIST NVD

   Detected

   Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to version 1.4.10, the verifyIdentity() function contained logic that returned true if no session cookies were present. This allowed unauthenticated attackers to bypass security checks and access/modify user settings via the /api/settings endpoint by providing arbitrary headers. This issue has been patched in version 1

2. Jul 24, 2026 · NIST NVD

   Updated

   Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to version 1.4.10, the verifyIdentity() function contained logic that returned true if no session cookies were present. This allowed unauthenticated attackers to bypass security checks and access/modify user settings via the /api/settings endpoint by providing arbitrary headers. This issue has been patched in version 1

Affected

• cpe bulwarkmail/webmailversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-34834

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-34834

  Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to version 1.4.10, the verifyIdentity() function contained logic that returned true if no session cookies were present. This allowed unauthenticated attackers to bypass security checks and access/modi

  nvd.nist.gov

References

• Product · github.com
• Vendor Advisory · github.com