Executive brief
Bulwark Webmail is a self-hosted webmail interface used to access Stalwart Mail Servers. A security flaw in the application's authentication system caused users' plaintext passwords to be included in certain web responses. This could allow unauthorized individuals to steal user credentials by inspecting browser logs, local web caches, or network traffic passing through intermediate proxies.
Technical details
Bulwark Webmail prior to version 1.4.10 is vulnerable to information exposure (CWE-312) via the GET /api/auth/session endpoint. The application's API response for session information incorrectly included the user's plaintext password in the JSON body. This exposure allows credentials to be captured in browser history, local caches, or by network intermediaries such as transparent proxies. The vulnerability is remediated in version 1.4.10 by removing the password from the GET handler and moving session restoration credentials to a new PUT handler protected by 'Sec-Fetch-Site: same-origin' headers to prevent cross-origin access.
Affected products
- bulwarkmail Bulwark Webmail < 1.4.10
Timeline
- 2026-03-30: patched: Version 1.4.10 released
- 2026-03-31: advisory: GitHub Security Advisory published
- 2026-04-02: disclosed: CVE published to NVD