Bulwark Webmail: verifyIdentity() 函数中缺失的 Cookie 验证导致身份验证绕过

An attacker exploiting this vulnerability can bypass authentication and directly access the /api/settings endpoint. This allows them to modify user settings, potentially gaining control over user accounts or altering the webmail client's configuration. The impact extends to the confidentiality and integrity of user data and the overall security of the Stalwart Mail Server environment. While the vulnerability doesn't directly lead to remote code execution, the ability to modify user settings can be leveraged for further malicious activities, such as phishing or account takeover.

Organizations using Stalwart Mail Server with Bulwark Webmail versions prior to 1.4.10 are at risk, particularly those with exposed webmail instances or those lacking robust network segmentation. Shared hosting environments where multiple users share the same Bulwark Webmail instance are also at increased risk.

1. 2026-04-02Disclosure

   disclosure

1. 已保留2026-03-30
2. 发布日期2026-04-02
3. 修改日期2026-04-03
4. EPSS 更新日期2026-04-10

The primary mitigation for CVE-2026-34834 is to immediately upgrade Bulwark Webmail to version 1.4.10 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds such as restricting access to the /api/settings endpoint to trusted IP addresses or implementing stricter authentication measures. Review web server access logs for suspicious activity related to the /api/settings endpoint. After upgrading, confirm the fix by attempting to access the /api/settings endpoint without valid authentication cookies; the request should be rejected.