CVE-2026-35391

CVE-2026-35391 is an IP spoofing vulnerability in Bulwark Webmail versions prior to 1.4.11, a self-hosted webmail client for Stalwart Mail Server. The flaw exists in the getClientIP() function, which incorrectly trusts the leftmost entry of the X-Forwarded-For header without proper validation, allowing attackers to forge their source IP address. The vulnerability carries a CVSS score of 7.5 (HIGH) with a network-based attack vector requiring no authentication or user interaction. The primary impact is integrity compromise, as attackers can bypass IP-based rate limiting to conduct brute-force attacks against administrative accounts and fabricate audit log entries to mask malicious activity. There is no evidence of active exploitation in the wild, as the vulnerability is not listed on the KEV catalogue and maintains an inactive status on vulnerability tracking lists. The EPSS score of 0.0002 indicates minimal real-world exploitation likelihood. Organizations running Bulwark Webmail should prioritize upgrading to version 1.4.11 or later to remediate this administrative control evasion risk.