CVE-2026-35391
High
Description
Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.4.11, the getClientIP() function in lib/admin/session.ts trusted the first (leftmost) entry of the X-Forwarded-For header, which is fully controlled by the client. An attacker could forge their source IP address to bypass IP-based rate limiting (enabling brute-force attacks against the admin login) or forge audit log entries (making malicious activity appear to originate from arbitrary IP addresses). This vulnerability is fixed in 1.4.11.
SeverityHigh
CVSS7.5
Exploit probability—
ProductBulwarkmail Webmail
PublishedApr 6, 2026
First seenApr 6, 2026
Weakness typeCWE-348CWE-348
How to fix
Update
- bulwarkmail webmail1.4.11 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| bulwarkmail webmail | v < 1.4.11 | 1.4.11 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.