CVE-2026-35389

Bulwark Webmail versions prior to 1.4.11 contain a vulnerability in S/MIME signature verification that fails to validate certificate trust chains, allowing any email signed with self-signed or untrusted certificates to be displayed as having valid signatures. This affects users of the self-hosted webmail client for Stalwart Mail Server who rely on cryptographic signature validation for email authentication and integrity assurance. The vulnerability has been remediated in version 1.4.11. The vulnerability carries a CVSS 7.5 HIGH severity rating with a network-based attack vector requiring no authentication or user interaction, making it easily exploitable from the internet. The primary impact is integrity compromise, as attackers can forge email signatures that will be displayed as legitimate, potentially enabling phishing and email spoofing attacks against users. However, confidentiality and availability are not affected. This vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities catalog and shows no signs of active exploitation in the wild. The EPSS score of 0.000220000 indicates minimal probability of exploitation within the next 30 days. Community attention appears limited, with no public exploit code availability reported. Organizations running affected versions should prioritize upgrading to version 1.4.11 to restore cryptographic verification integrity.