Bulwark Webmail accepted S/MIME signatures that used self‑signed or otherwise untrusted certificates because the signature verification process did not validate the certificate trust chain. This allows an attacker to sign a message with a certificate that the system will treat as trusted, giving the appearance of a legitimate signed email while enabling forging of otherwise authenticated messages. The weakness is recognized as improper certificate validation, which can be exploited to compromise the perceived integrity of email communications.

The affected product is Bulwark Webmail, a self‑hosted client for the Stalwart Mail Server. Versions prior to 1.4.11 are vulnerable, meaning any installation running 1.4.10 or earlier will accept untrusted signatures.

A CVSS score of 8.7 indicates high severity. No EPSS score is available, but the lack of trust chain validation suggests the flaw can be readily exploited by a remote attacker sending crafted messages. The vulnerability is not yet listed in the CISA KEV catalog, but its nature and severity make it a priority for patching. A likely attack vector is the injection of malicious signed emails, either unsolicited phishing attempts or legitimate-looking internal communications.