CVE-2026-35390

Bulwark Webmail versions prior to 1.4.11 contain a cross-site scripting (XSS) vulnerability in the reverse proxy component. The application incorrectly deployed the Content-Security-Policy-Report-Only header instead of the enforcing Content-Security-Policy header, allowing XSS attacks to be logged rather than blocked. An authenticated attacker could inject malicious script content through crafted email HTML to execute arbitrary JavaScript within the application context, potentially compromising session tokens or performing unauthorized actions. The vulnerability carries a CVSS score of 5.4 (Medium) with a network-based attack vector requiring low complexity and user interaction. Exploitation requires prior authentication (PR:L) and results in limited confidentiality and integrity impact. The EPSS score of 0.0003 indicates extremely low probability of exploitation in the wild relative to other known vulnerabilities. There is no evidence of active exploitation in the wild, no known public exploit code, and no designation on the KEV catalog or CISA Hot List. The vulnerability appears to have minimal community attention and low real-world exploitation risk. Organizations running Bulwark Webmail should prioritize updating to version 1.4.11 or later as part of routine patching cycles rather than emergency response procedures.