CVE-2026-34833

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-34833", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-30T20:52:53.284Z", "datePublished": "2026-04-02T19:11:39.303Z", "dateUpdated": "2026-04-03T15:40:57.901Z"}, "containers": {"cna": {"title": "Bulwark Webmail: Information Exposure: password returned in /api/auth/session", "problemTypes": [{"descriptions": [{"cweId": "CWE-312", "lang": "en", "description": "CWE-312: Cleartext Storage of Sensitive Information", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/bulwarkmail/webmail/security/advisories/GHSA-47pm-883h-885r", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/bulwarkmail/webmail/security/advisories/GHSA-47pm-883h-885r"}, {"name": "https://github.com/bulwarkmail/webmail/releases/tag/1.4.10", "tags": ["x_refsource_MISC"], "url": "https://github.com/bulwarkmail/webmail/releases/tag/1.4.10"}], "affected": [{"vendor": "bulwarkmail", "product": "webmail", "versions": [{"version": "< 1.4.10", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-02T19:11:39.303Z"}, "descriptions": [{"lang": "en", "value": "Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to version 1.4.10, the GET /api/auth/session endpoint previously included the user's plaintext password in the JSON response. This exposed credentials to browser logs, local caches, and network proxie. This issue has been patched in version 1.4.10."}], "source": {"advisory": "GHSA-47pm-883h-885r", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-03T15:40:47.651827Z", "id": "CVE-2026-34833", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-03T15:40:57.901Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-34833", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-03T15:40:47.651827Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-03T15:40:53.085Z"}}], "cna": {"title": "Bulwark Webmail: Information Exposure: password returned in /api/auth/session", "source": {"advisory": "GHSA-47pm-883h-885r", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "bulwarkmail", "product": "webmail", "versions": [{"status": "affected", "version": "< 1.4.10"}]}], "references": [{"url": "https://github.com/bulwarkmail/webmail/security/advisories/GHSA-47pm-883h-885r", "name": "https://github.com/bulwarkmail/webmail/security/advisories/GHSA-47pm-883h-885r", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/bulwarkmail/webmail/releases/tag/1.4.10", "name": "https://github.com/bulwarkmail/webmail/releases/tag/1.4.10", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to version 1.4.10, the GET /api/auth/session endpoint previously included the user's plaintext password in the JSON response. This exposed credentials to browser logs, local caches, and network proxie. This issue has been patched in version 1.4.10."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-312", "description": "CWE-312: Cleartext Storage of Sensitive Information"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-02T19:11:39.303Z"}}}, "cveMetadata": {"cveId": "CVE-2026-34833", "state": "PUBLISHED", "dateUpdated": "2026-04-03T15:40:57.901Z", "dateReserved": "2026-03-30T20:52:53.284Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-02T19:11:39.303Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "webmail", "vendor": "bulwarkmail", "versions": [{"status": "affected", "version": "< 1.4.10"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:bulwarkmail:webmail:*:*:*:*:*:*:*:*", "matchCriteriaId": "B7AD4211-CACD-4302-8C34-0C0D5B00F576", "versionEndExcluding": "1.4.10", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to version 1.4.10, the GET /api/auth/session endpoint previously included the user's plaintext password in the JSON response. This exposed credentials to browser logs, local caches, and network proxie. This issue has been patched in version 1.4.10."}, {"lang": "es", "value": "Bulwark Webmail es un cliente de webmail autoalojado para Stalwart Mail Server. Antes de la versi\u00f3n 1.4.10, el endpoint GET /api/auth/session inclu\u00eda previamente la contrase\u00f1a en texto plano del usuario en la respuesta JSON. Esto expon\u00eda las credenciales a los registros del navegador, cach\u00e9s locales y proxies de red. Este problema ha sido parcheado en la versi\u00f3n 1.4.10."}], "id": "CVE-2026-34833", "lastModified": "2026-07-24T21:10:00.143", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34833", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-03T15:40:47.651827Z", "version": "2.0.3"}}]}, "published": "2026-04-02T20:16:27.423", "references": [{"source": "security-advisories@github.com", "tags": ["Product"], "url": "https://github.com/bulwarkmail/webmail/releases/tag/1.4.10"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/bulwarkmail/webmail/security/advisories/GHSA-47pm-883h-885r"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-312"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.4.10)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "webmail", "source": "cna", "vendor": "bulwarkmail"}, "product": "webmail", "vendor": "bulwarkmail"}], "analysis": {"en": {"generated_at": "2026-04-10T00:25:10.665995+00:00", "value": {"mitigation_remediation": ["Upgrade Bulwark Webmail to version 1.4.10 or newer to remove the plaintext password from the /api/auth/session response.", "Confirm that subsequent API responses no longer expose user credentials.", "Examine browser logs, local caches, and network captures for evidence of exposed passwords and require impacted users to reset passwords."], "summary": {"action": "Patch immediately", "impact": "Plaintext credential exposure via API response"}, "threat_synthesis": {"affected_systems": "Any Bulwark Webmail deployment running a version before 1.4.10 is affected regardless of its hosting environment or network configuration. The vulnerability is linked to the authentication data returned by the web interface and therefore applies to all users of the affected service.", "description_and_impact": "Bulwark Webmail inadvertently returned the user\u2019s plaintext password in the JSON payload from the GET /api/auth/session endpoint. This flaw, a Classic CWE-312 weakness, allows anyone who can observe the response\u2014through browser logs, local caches, or network proxies\u2014to capture valid login credentials without additional attack steps.", "risk_and_exploitability": "The vulnerability scores a CVSS base of 8.7, indicating a high impact on confidentiality. With an EPSS below 1% and no record in the CISA KEV catalog, exploitation opportunities are currently limited but still possible. An attacker only needs to send a standard HTTP request to the vulnerable API or intercept the traffic; no elevated privileges or code execution are required. Once the plaintext password is retrieved, the attacker can log in to the mail system, potentially access other services tied to the same account, and compromise the user\u2019s overall security posture."}}}}, "created": "2026-04-03T07:31:28.367797+00:00", "updated": "2026-04-10T09:45:43.481223+00:00", "vendors": ["bulwarkmail", "bulwarkmail$PRODUCT$webmail"]}