CVE-2026-35389 — Bulwark Webmail S/MIME signature verification accepted self-signed certificates

CVE-2026-35389

Bulwark Webmail S/MIME signature verification accepted self-signed certificates PUBLISHED

Description (CNA)

Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.4.11, S/MIME signature verification did not validate the certificate trust chain (checkChain: false). Any email signed with a self-signed or untrusted certificate was displayed as having a valid signature. This vulnerability is fixed in 1.4.11.

Affected (CNA)

Vendor / product	Versions
bulwarkmail / webmail	affected < 1.4.11

CWE

CWE-295

References

https://github.com/bulwarkmail/webmail/security/advisories/GHSA-v6w6-338p-p256

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.