The vulnerability allows an attacker to perform server‑side request forgery by exploiting the check‑then‑fetch logic in Bulwark Webmail’s public iCalendar fetch endpoint. An attacker who controls the authoritative DNS for a hostname supplied to POST /api/fetch‑ical can first cause the server’s validation logic to resolve the hostname to a public IP address, then rebind that hostname to a private, loopback, link‑local, or infrastructure metadata address before the actual fetch occurs. The server will then retrieve the remote internal resource and return up to 10 MB of the response to the attacker, exposing sensitive internal data. The same logic flaw also existed in authenticated JMAP login and TOTP token‑exchange flows, expanding the attack surface for authenticated users.

Bulwark Webmail versions earlier than 1.9.2 are affected. The vulnerable endpoints include the public POST /api/fetch‑ical, as well as authenticated JMAP login and TOTP token‑exchange paths. Upgrading to version 1.9.2 or later removes the flaw.

With a CVSS score of 7.5, the vulnerability poses a high risk, especially for publicly reachable deployments that expose the /api/fetch‑ical endpoint. Exploitation requires control of a DNS name associated with the target server; no known exploits are listed in the KEV catalogue and the EPSS score is not available. The likely attack vector is an external attacker directing the server to make internal requests via malicious hostname rebindings.