The vulnerability resides in the verifyIdentity() function of Bulwark Webmail. When no session cookies are present, the function returns true, allowing an attacker who is not authenticated to bypass all security checks. This permits the attacker to call the /api/settings endpoint with arbitrary headers and change user settings, effectively taking over account configuration. The weakness is a classic authentication bypass (CWE‑287) that grants unauthorized users control over mail settings.

Self‑hosted Bulwark Mail Webmail deployments running any version prior to 1.4.10 are affected. The vulnerability exists in the verifyIdentity() path used for all API requests, including the /api/settings endpoint. Users should verify the version they are running and identify any installations older than 1.4.10.

The vulnerability has a CVSS score of 8.7, classifying it as High severity. The EPSS score is less than 1%, indicating a low likelihood of exploitation observed so far, and it is not listed in the CISA KEV catalogue. Exploitation requires only that the attacker can reach the webmail server over the network, and no authentication credentials are needed. Therefore, the attack vector is remote over HTTP/HTTPS, with the attacker able to send arbitrary headers to the API endpoint to obtain configuration privileges.