CVE-2026-34834

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-34834", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-30T20:52:53.284Z", "datePublished": "2026-04-02T19:11:54.448Z", "dateUpdated": "2026-04-03T18:11:56.037Z"}, "containers": {"cna": {"title": "Bulwark Webmail: Authentication Bypass in verifyIdentity() due to missing cookie validation", "problemTypes": [{"descriptions": [{"cweId": "CWE-287", "lang": "en", "description": "CWE-287: Improper Authentication", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/bulwarkmail/webmail/security/advisories/GHSA-4356-876g-rfmh", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/bulwarkmail/webmail/security/advisories/GHSA-4356-876g-rfmh"}, {"name": "https://github.com/bulwarkmail/webmail/releases/tag/1.4.10", "tags": ["x_refsource_MISC"], "url": "https://github.com/bulwarkmail/webmail/releases/tag/1.4.10"}], "affected": [{"vendor": "bulwarkmail", "product": "webmail", "versions": [{"version": "< 1.4.10", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-02T19:11:54.448Z"}, "descriptions": [{"lang": "en", "value": "Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to version 1.4.10, the verifyIdentity() function contained logic that returned true if no session cookies were present. This allowed unauthenticated attackers to bypass security checks and access/modify user settings via the /api/settings endpoint by providing arbitrary headers. This issue has been patched in version 1.4.10."}], "source": {"advisory": "GHSA-4356-876g-rfmh", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-02T20:18:07.477640Z", "id": "CVE-2026-34834", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-03T18:11:56.037Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-34834", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-02T20:18:07.477640Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-02T20:18:17.285Z"}}], "cna": {"title": "Bulwark Webmail: Authentication Bypass in verifyIdentity() due to missing cookie validation", "source": {"advisory": "GHSA-4356-876g-rfmh", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "bulwarkmail", "product": "webmail", "versions": [{"status": "affected", "version": "< 1.4.10"}]}], "references": [{"url": "https://github.com/bulwarkmail/webmail/security/advisories/GHSA-4356-876g-rfmh", "name": "https://github.com/bulwarkmail/webmail/security/advisories/GHSA-4356-876g-rfmh", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/bulwarkmail/webmail/releases/tag/1.4.10", "name": "https://github.com/bulwarkmail/webmail/releases/tag/1.4.10", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to version 1.4.10, the verifyIdentity() function contained logic that returned true if no session cookies were present. This allowed unauthenticated attackers to bypass security checks and access/modify user settings via the /api/settings endpoint by providing arbitrary headers. This issue has been patched in version 1.4.10."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287: Improper Authentication"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-02T19:11:54.448Z"}}}, "cveMetadata": {"cveId": "CVE-2026-34834", "state": "PUBLISHED", "dateUpdated": "2026-04-03T18:11:56.037Z", "dateReserved": "2026-03-30T20:52:53.284Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-02T19:11:54.448Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "webmail", "vendor": "bulwarkmail", "versions": [{"status": "affected", "version": "< 1.4.10"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:bulwarkmail:webmail:*:*:*:*:*:*:*:*", "matchCriteriaId": "B7AD4211-CACD-4302-8C34-0C0D5B00F576", "versionEndExcluding": "1.4.10", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to version 1.4.10, the verifyIdentity() function contained logic that returned true if no session cookies were present. This allowed unauthenticated attackers to bypass security checks and access/modify user settings via the /api/settings endpoint by providing arbitrary headers. This issue has been patched in version 1.4.10."}, {"lang": "es", "value": "Bulwark Webmail es un cliente de webmail autoalojado para Stalwart Mail Server. Antes de la versi\u00f3n 1.4.10, la funci\u00f3n verifyIdentity() conten\u00eda l\u00f3gica que devolv\u00eda verdadero si no hab\u00eda cookies de sesi\u00f3n presentes. Esto permit\u00eda a atacantes no autenticados eludir las comprobaciones de seguridad y acceder/modificar la configuraci\u00f3n del usuario a trav\u00e9s del endpoint /api/settings al proporcionar encabezados arbitrarios. Este problema ha sido parcheado en la versi\u00f3n 1.4.10."}], "id": "CVE-2026-34834", "lastModified": "2026-07-24T21:10:00.143", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34834", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-02T20:18:07.477640Z", "version": "2.0.3"}}]}, "published": "2026-04-02T20:16:27.983", "references": [{"source": "security-advisories@github.com", "tags": ["Product"], "url": "https://github.com/bulwarkmail/webmail/releases/tag/1.4.10"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/bulwarkmail/webmail/security/advisories/GHSA-4356-876g-rfmh"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.4.10)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "webmail", "source": "cna", "vendor": "bulwarkmail"}, "product": "webmail", "vendor": "bulwarkmail"}], "analysis": {"en": {"generated_at": "2026-04-09T22:59:14.421611+00:00", "value": {"mitigation_remediation": ["Verify the current Bulwark Webmail version on each host.", "If the version is older than 1.4.10, upgrade the package or apply the patch from the 1.4.10 release.", "Restart the Bulwark Webmail service to load the new code.", "Test the /api/settings endpoint to confirm that authentication is now required."], "summary": {"action": "Patch Immediately", "impact": "Unauthorized access and privileged configuration changes"}, "threat_synthesis": {"affected_systems": "Self\u2011hosted Bulwark Mail Webmail deployments running any version prior to 1.4.10 are affected. The vulnerability exists in the verifyIdentity() path used for all API requests, including the /api/settings endpoint. Users should verify the version they are running and identify any installations older than 1.4.10.", "description_and_impact": "The vulnerability resides in the verifyIdentity() function of Bulwark Webmail. When no session cookies are present, the function returns true, allowing an attacker who is not authenticated to bypass all security checks. This permits the attacker to call the /api/settings endpoint with arbitrary headers and change user settings, effectively taking over account configuration. The weakness is a classic authentication bypass (CWE\u2011287) that grants unauthorized users control over mail settings.", "risk_and_exploitability": "The vulnerability has a CVSS score of 8.7, classifying it as High severity. The EPSS score is less than 1%, indicating a low likelihood of exploitation observed so far, and it is not listed in the CISA KEV catalogue. Exploitation requires only that the attacker can reach the webmail server over the network, and no authentication credentials are needed. Therefore, the attack vector is remote over HTTP/HTTPS, with the attacker able to send arbitrary headers to the API endpoint to obtain configuration privileges."}}}}, "created": "2026-04-03T07:31:27.328533+00:00", "updated": "2026-04-10T09:45:42.469764+00:00", "vendors": ["bulwarkmail", "bulwarkmail$PRODUCT$webmail"]}