Bulwark Webmail does not validate the S/MIME certificate chain during signature verification, allowing messages signed with self‑signed or untrusted certificates to appear as authentic. This enables attackers to forge email signatures, potentially allowing phishing, disinformation or credential theft attacks against users who trust the signature. The weakness aligns with CWE‑295 and can compromise email integrity.

Vendors: Bulwark Webmail. Product: Bulwark Webmail, a self‑hosted webmail client for the Stalwart Mail Server. Versions prior to 1.4.11 are affected; the vulnerability is fixed in 1.4.11.

The CVSS score of 8.7 indicates high severity, while the EPSS score of less than 1% suggests a low likelihood of widespread exploitation. The vulnerability is not listed in the CISA KEV database. An attacker would need only the ability to send a signed email that uses a self‑signed certificate; if the target trusts the signature, the attacker can bypass email authenticity checks. Because the vulnerability is easy to exploit and can lead to widespread deception, administrators should treat it as high risk.